u/mailbox_org

Inclusion in the BSI Hall of Fame 2026

Having already been awarded BSI Gold status in the 2025 Email Security Year, mailbox has once again been inducted into the Hall of Fame this year: in 2026, the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI), eco, the German Association of the Internet Industry (eco, Verband der Internetwirtschaft e. V.) and Bitkom e. V. focused on the implementation of the DNSSEC email security standard.

What is DNSSEC?

DNSSEC stands for Domain Name System Security Extensions and uses cryptographic signatures to protect DNS queries against tampering and forged responses. This makes it possible to verify whether the DNS data provided for a domain actually originates from the relevant operator and has not been altered en route.

Security at mailbox

mailbox has been successfully implementing DNSSEC and other modern security standards for years, so we are all the more delighted about the independent audit and confirmation by the BSI.

Understanding and implementing email security

What exactly are DNS and DNSSEC, why is DNSSEC so important, and what should you bear in mind when using your own custom domains? Find out more in our article: https://mailbox.org/en/news/bsi-hall-of-fame-2026-DNSSEC/

A company's GDPR compliance and the quality of their information security determine whether customers and business partners can place their trust in them.

Trustworthiness as a foundation

Customer loyalty and business relationships that last for years are based on the repeated experience that one can trust the organisation. A company that views data protection and information security as a means of building relationships is doing more than simply fulfilling a duty of care.

Trust as a source of potential

Many organisations today seek written confirmation of trustworthiness from their service providers and suppliers: in supplier questionnaires, vendor assessments and tender documents. Those who can meet these requirements win contracts.

Consequences of IT decisions

The choice of IT infrastructure helps determine the quality of a company's information security and data protection. Companies thereby influence their own reliability – and, consequently, how resilient and successful their business relationships are, both now and in the future.

In our blog, we show you …

• how the fundamental need for trust shapes business relationships,
• how data protection and information security differ,
• what role the choice of communications infrastructure plays in a company's duty of care, and
• how companies can create a security culture that underpins their long-term trustworthiness.

Find out more about this on our blog: https://mailbox.org/en/blog/data-protection-and-information-security-for-businesses/

More than just a contact address

For most people, their email address has long since become the central key to their digital identity. When you use your main address repeatedly, individual fragments are used to build a detailed profile of you.

This is precisely what makes it so attractive to data brokers and cybercriminals.

Spam

Spam is the result of a market in which email addresses are collected, traded and resold. Once your address has ended up in this cycle, it is very difficult to get it out again.

This is particularly true if, like most people, you use the same address everywhere, thereby providing data brokers with a point of reference against which information from a wide variety of sources can be collated.

What is an email alias and how does it protect against spam?

An email alias breaks this very pattern. Using email aliases reveals who is passing on your data, makes it harder to create profiles and carry out phishing attacks, and, as an added bonus, keeps your inbox organised. If you spot any misuse, you can disable individual aliases.

In our blog, we show you how spam actually comes about, how an email alias works and protects your inbox, what you can use it for, and the best way to go about creating email aliases: https://mailbox.org/en/blog/email-alias-protection-against-spam/

The cloud you use determines how much control you retain over your data – and how much you relinquish.

Dependence on hyperscalers

Hyperscalers are cloud providers with massive resources for computing and storage power, as well as network infrastructure. Corporations such as AWS, Google and Microsoft operate large-scale data centres distributed across the globe.

These three hyperscalers currently process the vast majority of European corporate data.

Consequences of dependence

This concentration of vast amounts of data has implications for information security, data protection, compliance and your ability to act.

Criticism of the hyperscalers also extends to the environmental impact and other sustainability factors associated with massive data centres.

Identifying sovereign clouds

Find out more in our article about how clouds work, the implications of your choice of cloud provider, and what you can do to recognise a sovereign cloud and make independent decisions about your data: https://mailbox.org/en/blog/sovereign-cloud-providers/

Pragmatism

When the primary communication platform fails, staff often resort to personal accounts and improvised workarounds. Whether it’s a personal email account, a messenger group set up on the spur of the moment, or a free file-sharing service for quick file exchanges: resorting to shadow IT is, in principle, an understandable response in emergency situations.

However, the consequences of using shadow IT are serious: This ill-considered pragmatism poses risks to your organisation’s security and reputation.

Dangerous workarounds

For data protection and information security, resorting to shadow IT is disastrous. Furthermore, improvised communication via untrustworthy tools causes lasting damage to your reputation. On top of that, cybercriminals exploit the IT state of emergency as a breeding ground for phishing, CEO fraud and identity theft.

Professionalism and resilience instead of shadow IT

Offer your staff a better, reputable, secure and reliable alternative. Because having a prepared emergency communication plan protects two things at once: data and reputation.

In our blog, you can find out what the practical dangers of shadow IT are and why reliable emergency communication is a fundamental prerequisite for business continuity and reputation: https://mailbox.org/en/blog/avoiding-shadow-IT-in-an-emergency/

Email addresses are a key part of our digital identity: signing up for online services, order confirmations, newsletters and countless other online activities would be unthinkable without them. However, sharing your email address comes with risks.

Email addresses as a gateway

As soon as an email address falls into the wrong hands, it becomes a potential gateway for various threats. Every time you share your email address, the risk of falling victim increases, for example to

• unsolicited marketing emails (spam)
• targeted phishing attacks by cybercriminals
• fraud attempts resulting from data breaches

This is where disposable email addresses offer a solution: they act as a digital shield for your main address and protect you from unwanted messages.

Disposable email addresses: protection against spam and data misuse

A disposable email address is a temporary email address created for a specific purpose and which can be ‘disposed of’ after use. Incoming messages to disposable addresses are forwarded to the primary inbox without the sender knowing the real email address. This helps protect against long-term spam attacks and data misuse.

Greater control over your digital identity

Find out exactly how disposable addresses work, in which situations they are used, and how you can use them with mailbox in our blog: https://mailbox.org/en/blog/how-disposable-addresses-protect-against-digital-threat/

CEO Fraud & Co: The most expensive email your company never sent

Business Email Compromise (BEC) is a sophisticated and widespread form of cyber fraud. It ranks among the most financially damaging cyber threats, alongside ransomware, phishing and DDoS attacks.

BEC is an umbrella term for variants of email fraud that exploit social engineering. Attackers exploit deeply human traits and capitalise on the fact that email is generally regarded as trustworthy. Rapid developments in AI are taking BEC to a whole new level of threat.

Protection against BEC

By combining these measures, you can minimise your organisation’s vulnerability to Business Email Compromise:

• technical safeguards
• organisational processes
• regular staff training
• robust, GDPR-compliant email infrastructure
• business continuity strategy for emergencies

Recognise & prevent

In our blog, you can find out how Business Email Compromise works, how artificial intelligence is increasing the cyber threat, and how you can protect yourself against this new generation of email fraud: https://mailbox.org/en/blog/business-email-compromise-protection-against-email-fraud/

Digital sovereignty starts in your inbox

Millions of people use free email services such as Gmail or GMX every day. What looks like a good deal at first glance is actually based on a business model that primarily benefits the provider.

The business model

When a service is free, an obvious question arises: how does the provider make money?

The truth is: supposedly free email is a lucrative business that thrives on having as precise an understanding as possible of its users. The more a provider knows about the users of its service, the more valuable an advert placement becomes.

Your email account

Your email account is one of the most private digital spaces there is. The question of whom you entrust this account to, and what financial interest the provider has in exploiting it, thus becomes a decision about your own digital sovereignty.

Digital self-determination

If you understand how the business model behind free email providers works, you can make more informed and critical decisions about whose hands you place your private data in.

In our blog, you can find out what lies behind supposedly free services, where the specific data protection risks lie, and what you should bear in mind when switching to a secure, ad-free email account: https://mailbox.org/en/blog/what-free-email-really-costs/

What are family accounts?

In family accounts, several independent mailbox accounts are grouped together. Members of this group can grant each other access to various resources. Additionally, all members of a group share common Drive storage space.

Features

With a mailbox family account, you can enjoy shared use of the digital workspace's features:

• Sharing and editing files and folders, mailboxes and tasks
• Jointly managing and synchronising calendars and contacts
• Use of custom domains by each family member
• Administrator can manage permissions and access rights for family members
• Joint and separate billing

Find out how to set up family accounts with mailbox and use the features: https://kb.mailbox.org/en/private/family-account/

Many organisations assume that their emails are transmitted securely. However, there are several dangerous stages between sending and receiving a message.

Risks in email communication:

Emails pass through several servers and network nodes on their way to the recipient. At each of these points, there is always the possibility that messages could be intercepted, copied or manipulated.

Potential risks include:

• external attackers
• incorrect configurations
• compromised servers
• unsecure Wi-Fi connections

Email encryption provides protection precisely at these points – provided it is implemented correctly and actually used by staff.

Email encryption:

Email encryption is a fundamental prerequisite for trustworthy digital communication – in businesses, public authorities and wherever sensitive information is exchanged on a daily basis.

The real challenge lies not in technology, but in safety culture: Email encryption must become standard practice in the day-to-day operations of organisations.

Clear guidelines, practical training and tools that work: find out how to successfully implement email encryption within your organisation in our blog on email encryption in businesses and public sector organisations. →  https://mailbox.org/en/blog/e-mail-encryption-for-companies-and-authorities/

Since 1 January 2026, the initiative has been helping people switch from Big Tech to digitally sovereign alternatives: whether that be messaging and email services, social media platforms, search engines, cloud storage or other digital services.

The DI.DAY website is now finally available in English – and with it, all the guides and tips for the path to greater digital self-determination: https://di.day/en