dmcn
Company

What we protect, and what we cannot

2 Oct 2026

DMCN is private and trustworthy because of how it’s built, rather than because we ask you to take our word for it. Here’s exactly how your mail is protected, and where the limits are.

Encrypted end-to-end within DMCN

Between DMCN inboxes, your mail is locked on your device and opened only by the person you send it to. We only ever handle the encrypted version.

Only you hold the key

We never hold a copy of your keys that we could open, and none is escrowed anywhere. The one time an encrypted copy passes through us is when you add a device: it is sealed to a key only that device holds, and deleted once it arrives. Nothing on our servers could be used to read your mail between DMCN inboxes.

Cryptographically verified senders

Between DMCN inboxes the network verifies who sent a message before it is accepted, and your client re-checks that sender against the key their domain publishes. If the two disagree you are warned, and nothing in the message renders or loads until you have checked.

Protected all the way to the bridge

Mail to and from regular email is secured in transit. Our bridge decrypts it to pass it between the two systems, so it isn’t end-to-end encrypted, and we are upfront about that.

No ads, no tracking

We make money from subscriptions, not from your data. Nothing is scanned, profiled or sold, ever.

Open to scrutiny

Our security claims are meant to be checked rather than taken on faith. The DMCNP protocol spec and an Apache-2.0 reference implementation are published in full at dmcn.dev, so anyone can read the wire format, audit it, or run their own server.

The path a message takes

  1. On your device. Your message is encrypted before it ever leaves your device, using keys only you hold.
  2. On our servers. It is stored and passed on as a sealed packet; our servers hold no key that opens it.
  3. On their device. Only your recipient can unlock it. Between DMCN inboxes, no one in the middle can read a word.

How the protocol does this, in full: dmcn.dev.

Being honest about the edges.

Mail to and from regular email. It is decrypted at the bridge and protected in transit (TLS), so it is not end-to-end encrypted the way DMCN-to-DMCN mail is. End-to-end encryption applies between DMCN inboxes.

Delivery metadata. A relay carries your mail sealed, but it does see who a message is from and which mailbox it is for. Stronger protection for that delivery metadata, onion-routed transport, is built but not yet switched on by default. It is on the roadmap, and we will say so here when it changes.

Adding a new device. This is the one moment key material crosses the network. Your keys travel sealed to that device alone, and you confirm a matching code on both screens. The new device deletes the copy as soon as it has them, but that delete is best effort and we would rather not have it be the only thing between you and a stale copy: the sealed message expires by itself within fifteen minutes either way. It is a short window, and we would rather name it than leave it out.

Found something? Tell us privately

If you believe you have found a vulnerability, write to security@dmcn.email and we will work with you to fix it quickly, and credit you if you would like.

  • We respond within two business days
  • Coordinated disclosure, no legal threats
  • Public thanks for verified reports