Why email is the first target
Email is universal, it is trusted by habit, and a mailbox is a master key: password resets for every other system land in it. The attacks that matter to a Zambian business are not exotic. They are phishing messages that look like they come from a colleague, invoice fraud where a supplier's bank details are "updated" by a spoofed address, and credential theft followed by quiet forwarding rules that copy every message out. Each is stopped by a different control, which is why one product feature is never enough.
The controls, and what ontechmail does
Encryption in transit
Every connection to the platform is encrypted with TLS: HTTPS with HSTS for webmail and the API, IMAP on port 993, POP3 on 995, and SMTP submission on 465 (implicit TLS) or 587 (STARTTLS, required before login). Mail exchanged with other providers uses opportunistic STARTTLS, which is the industry norm; end-to-end encryption of message content (such as PGP) is a separate layer applied in the client and is not something a mail host can provide on its own.
Account security
Passwords are stored as bcrypt hashes, never in clear text. Users can enable two-factor authentication with a time-based code from an authenticator app and receive hashed recovery codes; sessions are token-bound and expire. The OMail app signs in by scanning a QR code from an already-authenticated webmail session, so the password is never typed on the phone.
Sender authentication
Every domain gets its own key pair and every outgoing message is DKIM-signed with it. The dashboard supplies the SPF and DMARC records for the domain. Together these let receiving servers reject mail that claims to be from you but is not, which is the single most effective defence against your brand being used in fraud.
Inbound filtering
On delivery, each message is scored using DKIM verification results and content signals, and likely junk is filed into Spam. This scorer is deliberately conservative and is not a full rspamd-class engine; users supplement it with per-mailbox rules, sender blocking and the report-spam action, which trains the filter.
Safe rendering
HTML mail is displayed inside a sandboxed frame in which scripts cannot run. Remote images are replaced with a blank pixel by default, so tracking pixels do not fire and your IP address is not disclosed; if you choose to load them, they are fetched through a same-origin proxy rather than directly from the sender.
Abuse prevention
The inbound receiver only accepts mail for known local mailboxes or a catch-all on a hosted domain, so it cannot be used as an open relay. Per-mailbox quotas and send limits, loop-safe autoresponders and an audit log of administrative and provisioning actions round out the platform controls.
What is your responsibility
No host can secure a mailbox whose owner reuses a leaked password or clicks through a fake login page. The controls that only you can apply:
- Turn on two-factor authentication for every account, starting with administrators.
- Publish DMARC at
p=rejectonce your legitimate senders are aligned. - Review forwarding rules and connected clients periodically.
- Verify changes to supplier bank details by phone, never by reply.
Where the data lives
Security and jurisdiction are different questions. On the hosted service, mailboxes are stored on Ontech-operated infrastructure in Zambia; organisations can also run the platform on their own servers. What that means for compliance obligations is set out plainly on the data sovereignty page.
Frequently asked questions
Why is email security important for a business?
Email is the most common entry point for phishing, credential theft and invoice fraud, and it carries contracts, payroll and customer data. A compromised mailbox lets an attacker impersonate your staff and read everything they have ever been sent.
Is my mail encrypted?
All connections to ontechmail use TLS: HTTPS for webmail and the API, IMAP on port 993, POP3 on 995 and SMTP submission on 465 or 587. Mail exchanged with other providers uses STARTTLS where the other side supports it, which is standard across the industry.
What is two-factor authentication?
Two-factor authentication requires a second proof of identity when signing in, in ontechmail's case a time-based one-time code from an authenticator app plus hashed recovery codes. A stolen password alone is then not enough to open the mailbox.
Does ontechmail filter spam?
Yes. A built-in scorer checks DKIM results and content signals on every delivered message and files likely junk into Spam. Users can also report spam, block senders and add their own filtering rules.