Hoq Email

Mail is served over JMAP, IMAP, POP3 and SMTP, with Sieve filters managed over JMAP or ManageSieve. Thunderbird, Outlook and Apple Mail set themselves up from just the email address; on iPhone and Mac, one signed profile download configures Mail, Calendar and Contacts in a tap.

Outgoing mail is signed with DKIM and checked against SPF, DMARC and ARC; delivery is protected with DANE and MTA-STS. Users can send from an outside address after proving they own it. TLS certificates for domains hosted on the service are issued automatically.

Signing in

• Passkeys instead of passwords, with two-factor codes as an alternative.
• Separate app passwords for mail apps.
• The web app holds a 15-minute token, not your password — access ends the moment it is revoked.

Incoming mail is scored with rules, blocklists, a trained classifier, sender reputation and phishing checks. Drop mail into Sentry's folders and it learns: reject, block, mark or allow close copies for you, your domain, or everyone. Whole senders or domains can be blocked outright, and mail can be sorted into Social, Promotions, Updates and Forums based on rules each person's own behavior teaches.

• Calendars and contacts sync over CalDAV, CardDAV and JMAP, with meeting invitations and organization-wide free/busy sharing.
• Files live in a drive that speaks WebDAV and JMAP — it mounts on a computer and opens in the web app.
• Earlier file versions are kept and openable; files can be shared by public link, checked at every open, revocable at any time.
• File activity shows who opened or changed a file, including anonymous visits through a share link.

With bring-your-own-bucket, an account's mail and files are kept in your own S3 bucket, in an archive format you can read without us. Changes — flags, moves, deletions — are written back so the bucket stays the true copy. An account can be rebuilt from its bucket with its original message ids, spam training travels with it, and retention clears archive history older than a number of days you choose.

Big mailboxes and All Mail open, and searches run, from a search index — not by reading every message. Search previews come from stored snippets before any full message is fetched.

• Any node serves any account: whichever server a person reaches, they are routed to the server holding their mail.
• Webhooks notify your own services when new mail arrives.
• Operators see each account's size and each server's memory, storage and response times — scoped to their tenants.
• Sign-in failures and security events are kept in a running security feed.