Email Security Guide: Tips for protecting your email inbox

Access and control: Who has access to your email account?

Choose secure passwords and use two-factor authentication (2FA)

Choose a secure password that makes it difficult for cybercriminals. The German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) recommends passwords that are 20 to 25 characters long and use two types of characters (e.g. random sequences of words), or those consisting of eight to 12 characters and four types of characters. Do not use names from your personal life, dates of birth, keyboard or repetition patterns, or numbers or special characters appended to a simple word.

Use your email password only for this one account and enable two-factor authentication. A password manager helps you to use different and strong passwords for all your accounts. Change your password if you suspect it has been compromised, for example following a data breach. In our Knowledge Base, we have summarised what you need to bear in mind regarding access security and when setting up two-factor authentication.

Use a secure recovery address

Set up password recovery before you activate two-factor authentication. This will help you avoid problems, such as if you lose your smartphone, which is used for two-factor authentication. Do not use an old email account as your recovery address – one that you haven’t actually used for years. Otherwise, the security of your mailbox will depend on a poorly protected account. Read in our Knowledge Base to find out how to store verification data in mailbox.

Check your linked devices and applications

You probably rarely access your mailbox solely via a browser on your laptop. In most cases, email clients, calendar apps, file synchronisation tools and, increasingly, AI assistants also access your account. Each of these access points represents a separate route to your data. Check your account settings regularly to see which devices and sessions are logged in and whether you can identify them with certainty.

Check your email account for forwarding rules and filters

If someone has gained access to your email account, it isn’t always immediately obvious to you. Someone may have set up a forwarding rule or a filter rule that sends copies of every incoming message to a third-party address. Your inbox will continue to function normally without you noticing anything. You should therefore check your filter rules, forwarding settings and application passwords.

Email encryption: Who can read your emails?

Encrypt emails in transit

There is a path between the sender and the recipient that emails should travel securely. Transport-layer encryption, known as Transport Layer Security (TLS), ensures the security of this path. TLS prevents anyone from reading your email communications on the journey from A to B. However, TLS does not protect against unauthorised access to the servers involved at points A and B.

Normally, you will never know whether your message was actually transmitted with transport encryption. The mailbox webmail client offers a way to find this out before you even send an email: As soon as you enter an email address in the ‘To’ field, an icon appears next to it indicating the security level of the destination system: connections secured via DANE and DNSSEC are specifically marked, as are basic TLS support and instances where information is missing. This allows you to decide for yourself, before sending, whether you wish to entrust the content to this method.

If you want to play it safe as a matter of principle, you can enable transport-encrypted sending with mailbox: If you send via secure.mailbox.org, the message will be delivered with transport encryption only – or not at all.

Use end-to-end encryption with PGP

If you want to ensure that no one other than the recipient can read the message, the content must be end-to-end encrypted. One open standard used for this is PGP – Pretty Good Privacy. With this method, both parties in the communication have a key pair consisting of a public key for encryption and a private key for decryption. We’ll show you how to use PGP with mailbox on our blog.

To encrypt incoming emails, you can use automatic mailbox encryption with PGP. This encrypts new messages in your inbox so that only people with your private PGP key and the corresponding password can access them. This significantly increases the security of your incoming emails, even if they were originally sent to you unencrypted.

Tips for using PGP securely:

• Back up your private key.
• Generate a revocation certificate and store it securely, in case a key is compromised or lost.
• Renew the expiry date of your keys regularly.
• Verify the fingerprint of a newly received key from another person via a second channel.

Encrypt and sign your emails with S/MIME

S/MIME stands for Secure/Multipurpose Internet Mail Extensions and is a certificate-based standard that is also built on a public key infrastructure and enables end-to-end encryption. An important difference from PGP is that S/MIME uses X.509 certificates issued by trusted certification authorities. S/MIME integrates well with common email clients.

Furthermore, S/MIME allows you to sign emails, thereby proving that a message originated from you and has not been tampered with in transit. You can find out more about how S/MIME works and how you can use it with mailbox on our blog.

Tip for using S/MIME securely:

Do not use or accept self-signed certificates; only use those issued by trusted certification authorities. Self-signed certificates are not classified as trustworthy by most email clients. They compromise secure email communication and do not provide reliable email authentication.

Share your files securely

Large or sensitive files do not belong in an email, but in an encrypted storage space from which you can send a (password-protected) sharing link. The advantage over sending them as email attachments is that a link can be deactivated. Once an attachment has been sent, you cannot retrieve it, and you have no control over the security measures the recipient takes for their email inbox. We’ve summarised what you should look out for when choosing your cloud storage in our blog.

Clear out old emails containing sensitive content

Emails often remain in inboxes for years and may contain highly sensitive attachments and information. If someone gains access to your email account, they may find copies of ID documents, tax records, login details sent in plain text, and similar items. So make use of the search function, download what you want to keep, and delete the rest. This can minimise the damage in the event of a breach.

Data protection and data minimisation: Who is analysing your data?

Choose a business model that respects your privacy

A free email account is only free in name. Advertising-funded providers use your data and activity to create an advertising profile, which they sell profitably to third parties. In our blog, we describe this business model and the implications it has for your privacy.

Structurally, you can solve this problem by choosing an email provider that is funded exclusively through usage fees and therefore has no reason to analyse your data and create a profile. In its 2026 test report, Stiftung Warentest recommends mailbox as an email service for users who value their privacy.

Check AI features and the permissions granted

Email content has become a highly sought-after source for training and processing. Summary and assistance features are now often enabled by default with major providers. This raises the question of where the content for these features is transferred to and what happens to it.

You should therefore carefully check

• the privacy settings of every service that accesses your email account: What analysis is set by default? And can it be disabled?
• the list of external applications to which you have granted read access, such as an AI assistant that summarises your correspondence.

Pay attention to server location and jurisdiction

Where the servers are located, who owns the hardware on which your emails are stored, and which law applies to the email provider determines who can demand access to your data and under what conditions. A German provider operating on its own hardware in its own data centre in Germany is subject to different rules than a service whose parent company or infrastructure owner is, for example, subject to US law. The degree of digital sovereignty of your email provider determines the protection of your data and your independence. Find out more here about digitally sovereign alternatives to US hyperscalers.

Don’t give tracking pixels, tracking links and read receipts no chance

Tracking pixels

Tracking pixels, or web beacons, are tiny, usually invisible images that are loaded from the sender’s server when you open an email. This allows the sender to find out whether and when you have opened the email, and often your IP address – and thus your approximate location – as well as your email programme and device.

Prevent tracking via web beacons:

• Block external content by default. Almost all email programmes and webmail interfaces have settings for this. You can still choose to reload content from trusted senders by clicking on it.
• You should also make use of other security features offered by the various email clients, which you can enable in the settings, or additional tools such as browser extensions.
• The best protection against tracking pixels is to view emails in plain text mode, as this means no images – and therefore no pixels – are loaded at all.

Tracking links

Tracking links first route through a server belonging to the sender or a service provider, which logs the click and then redirects you to the actual destination. They often contain a unique identifier that is specifically linked to your address. The sender not only finds out that you have opened the email, but also that you have clicked on a link, which link, when, using which IP address and on which device. This information can be linked to your profile via the unique identifier and is often combined with your subsequent behaviour on the website.

Furthermore, the displayed address often does not reveal where the link actually leads. Redirects can be misused to hide malicious destinations behind domains that appear trustworthy.

This makes link tracking more difficult:

• Hover your mouse pointer over the link before clicking, or press and hold the link to see the actual destination address.
• Access trusted destination addresses directly in your browser, rather than via the link in the email.
• As a general rule, only click on links from trusted senders.
• Please follow our advice on how to protect yourself against phishing and Business Email Compromise.
• Use browsers or browser extensions that automatically remove tracking parameters or block known redirects.

Read receipts

By replying to read receipts, you are also confirming to third-party senders that your email address is actively in use. For spammers and cybercriminals, this is valuable information and can result in even more unwanted emails or fraud attempts ending up in your inbox. Furthermore, read receipts reveal that you have opened the email and when, and, depending on the programme, also which email client you used. As a recipient, it is advisable to configure your email programme so that read receipts are never sent, or only sent upon request.

Separate your identities: aliases and disposable addresses

An address used everywhere is a common vulnerability. If it appears in a data breach, all your accounts are at risk. These tools will help you protect your email account from this:

Email aliases

An email alias is an additional email address that points to your existing inbox. Email aliases allow you to give each service its own email address, rather than using the same one everywhere. This makes it harder for your profile to be built up and protects your access. You can identify who is passing on your data and spot phishing attempts more quickly. To find out exactly how email aliases work, where and how best to use them, and how to set up email aliases in mailbox, visit on our blog.

Disposable addresses, one-off addresses or temporary email addresses

Disposable addresses are email addresses intended for a single occasion, such as logging into an airport Wi-Fi network. Be careful with temporary email services online, as expiry dates, data protection, security and blocking by providers can lead to problems. We explain here how to generate and use one-off addresses with mailbox.

Use an email address with your own domain

With your own domain, the address belongs to you and not to the provider. You retain full control over your email addresses and are free to switch email services. How secure your own email domain is depends, amongst other things, on your email provider and the configuration.

Avoid minor mishaps with major consequences

• Be careful when sending emails to a distribution list. Use the ‘BCC’ field instead of ‘CC’ to prevent the email addresses of numerous recipients from being displayed.
• The autocomplete feature in many email clients and webmail services suggests email addresses or names from your address book that you have used before as you type. This carries the risk of accidentally sending messages and attachments to names and addresses that sound similar when you’re in a hurry. Before sending the email, take another look at the recipient’s address to avoid data breaches and embarrassing situations.
• Do not include too many details in out-of-office messages, as this may reveal sensitive information to unauthorised senders.

Precaution: What happens if something goes wrong?

Back up your emails

An email backup is a copy of your emails. If emails are lost from a mailbox, you can restore the messages from the backup copy. You can find out how to back up and restore your emails using an email backup service from mailbox in our Knowledge Base.

Proceed with caution when switching email providers

As dozens of services are often linked to a single email account, many people are reluctant to switch email providers. However, making the switch is perfectly feasible – and with mailbox, you can use our free migration service. Please bear the following in mind during the process:

• First, create the new email account, including any aliases, and enter the new address for your most important accounts, starting with your bank, payment services and anything else that verifies your identity.
• Set up a forwarding from your old account and monitor what still arrives there over a few months. This way, you won’t overlook any forgotten accounts.
• Export any relevant content from your old mailbox.
• Only delete the old account after a generous transition period.

Manage your digital legacy

An email account without proper arrangements can become a problem in the event of death. You should therefore specify during your lifetime what is to happen to your email legacy and your login details. With mailbox, for example, you can choose whether your stored data should be deleted and your login details not disclosed to anyone, or whether your login details should be disclosed upon request by your heirs or by individuals you have specifically named.

By establishing clear rules for access to your email account, you can make provisions for the future in accordance with your own wishes. Please note that you should also make further decisions, for example regarding two-factor authentication or private keys for end-to-end encryption.

Draw up an emergency plan

Should a security incident occur, the order in which you take action is crucial:

1. Change your password.
2. End all active sessions.
3. Check any redirects, filter rules and application passwords, as a new password does not remove any settings that may have been set up secretly.
4. Take care of the accounts linked to this address, starting with your bank, payment services and the account that can be used to reset other passwords.
5. Inform your contacts, as a compromised email account is regularly used to steal money or data in the owner’s name.

Conclusion: Email security is about prevention and putting best practice into action

Email security is not a feature that is simply switched on once, but rather a series of small decisions and habits. You don’t have to do everything in a single day; instead, starting with strong access controls – a secure password and two-factor authentication – you can gradually put many further precautions in place and integrate them into your everyday email routine. mailbox offers you numerous automatically integrated and customisable options for this.