Email hosting comes to Hostney

You can now run your email on Hostney, on your own domain, from the same control panel you already use for your websites. Mailboxes, aliases, shared mailboxes, webmail in the browser, encrypted messages you can send to anyone, and full IMAP access for Apple Mail, Outlook, Gmail’s app, or whatever you already use on your phone. It is live today, and it is included on every paid plan.

If you have been forwarding your domain’s mail to a personal Gmail account, or paying separately for a mailbox somewhere else, this replaces that. Here is what you get, how to switch it on, and what the security and AI features actually do. There is also an email hosting page with the shorter version if you just want the feature list.

What is included, and on which plans#

Email is included on every paid plan. The number of mailboxes depends on your tier:

• Startup – 2 mailboxes
• Advanced – 5 mailboxes
• Pro – 10 mailboxes

The Trial plan does not include email hosting. Everything else does, at no extra cost.

One detail worth understanding, because it is not how every host does it: your mailbox allowance is shared across all the domains on your account, not counted per domain. If you are on Advanced with five mailboxes and you run three domains, you can put all five on one domain, or spread them across all three, or any split you like. You are not forced to buy a separate allowance for each domain you own.

Aliases and shared mailboxes do not count against that number. An alias is just a forwarding address – hello@yourdomain.com delivering into an existing mailbox – so you can have as many entry points as you want without spending an allowance on each. Shared mailboxes work the same way: a common support@ or billing@ that several people can open from their own accounts, without a separate login of its own.

Setting it up is three DNS records#

Email works because of DNS. Three records tell the rest of the internet where your mail lives and who is allowed to send as you:

• MX points incoming mail at our servers. If you want the longer version of how that routing works, we wrote MX records explained.
• SPF lists who may send mail using your domain. See what SPF is and how to set one up.
• DKIM cryptographically signs your outgoing mail so receivers can verify it really came from you. See what DKIM is.

You do not have to work any of this out yourself. Open Email in the control panel, pick your domain, and the setup page shows you the exact records with a live check next to each one. If your domain’s DNS is hosted with us, we publish them for you with one click. If your DNS lives elsewhere – Cloudflare, your registrar, wherever – the page gives you the exact values to paste, then re-checks and tells you when each one has gone live.

That check is genuinely useful, because misconfigured mail DNS is the single most common reason email silently stops working. Records propagate at different speeds, and a typo in an SPF record does not throw an error, it just quietly causes your mail to land in spam. The setup page tells you which record is wrong rather than leaving you guessing. If you are debugging mail that already exists elsewhere, our guide on why your email is not working covers the usual culprits.

We would also encourage setting up DMARC once your mail is flowing. It is the record that tells you who is sending mail as your domain, including anyone pretending to be you, and it is the one most people skip. What DMARC is and how to set it up explains it properly, and the control panel has a reporting page that turns the raw reports into something readable.

Two-step verification on the mailbox itself#

Every mailbox can have its own two-step verification, separate from your Hostney account login.

This distinction matters. Your control panel account and your mailbox are two different things that can be attacked in two different ways. Someone who gets into your control panel can change your hosting. Someone who gets into your mailbox can read your mail, and – because almost every other service on the internet sends password resets to your email address – reset your password everywhere else. A compromised mailbox is usually how a compromised everything-else starts.

So the mailbox gets its own protection. Turn on two-step verification and signing in to webmail needs your password plus a code from an authenticator app. If someone has your password, that is not enough.

If a mailbox user loses their authenticator, the account owner can reset two-step verification from the control panel, from that mailbox’s menu. Worth being deliberate about that one: resetting it means the password alone is enough to sign in again, so it is the right move when someone has genuinely lost their phone, and the wrong move if you suspect the mailbox has been broken into. In that case change the password first.

For your Hostney account itself, we would still point you at passkeys, which we launched earlier this year and which remove the password from the equation entirely. And if you are weighing up authenticator apps against SMS and hardware keys, the tradeoffs in our 2FA guide apply here just as much as they do to WordPress.

App passwords, and why you need them#

Here is the problem two-step verification creates, and the reason app passwords exist.

Your phone’s mail app connects over IMAP. IMAP has no concept of “now enter a code from your authenticator” – it is a protocol from long before two-step verification existed, and all it can do is send a username and a password. So the moment you turn on two-step verification, your mail app stops being able to sign in. It is not broken; it simply has no way to complete the second step.

An app password solves this. It is a long, random password that you generate for one specific device or app. You create it in webmail under Settings, give it a name like “iPhone” or “Outlook on the work laptop”, and use it in that app instead of your real password.

Three things make this better than just handing your real password to every device:

It is shown once. When you create an app password, you see it exactly one time, and we cannot show it to you again afterwards – not through support, not through the panel, because it is not stored in a recoverable form anywhere. If you lose it, you delete it and make a new one. That sounds inconvenient and it is the entire point: a credential nobody can retrieve is a credential nobody can be tricked into retrieving.

It is scoped to one device. Each app gets its own. If you lose your phone, you revoke the phone’s app password and every other device keeps working, untouched.

You can revoke it instantly. The control panel lists every app password on a mailbox – the name you gave it and when it was created – under the mailbox’s App passwords screen. Revoke one there and that device stops connecting immediately. You never see the password itself in that list, only the label, because there is no path anywhere in the system that can recover one.

Note that your real mailbox password still works for webmail sign-in. App passwords are specifically for mail apps that cannot do the second step. And a shared mailbox has no sign-in of its own, so there is nothing for an app password to authenticate – people open a shared mailbox through their own account instead.

Encrypted messages you can send to anyone#

Sometimes you need to email something that should not simply sit in someone’s inbox forever – an invoice with bank details, a contract, a password, a client’s documents. Normal email is a postcard. It gets copied across servers on the way, it lands in a mailbox you do not control, and once it has been sent you cannot take it back.

Every Hostney mailbox can send an encrypted message instead, and the person receiving it does not need a Hostney account or any software. It works like this:

1. You compose the message in webmail and send it as encrypted, to whichever addresses you choose.
2. Each recipient gets an ordinary-looking email containing a link – and nothing else. The content is not in that email.
3. They click the link, enter their email address, and we email them a six-digit code.
4. They enter the code and read the message in their browser, attachments included.
5. They can reply from that same page, and the reply comes back to you encrypted.

The important design decision is in step 2: the message itself never travels over email. The wrapper carries only a link. The content stays sealed on our mail server and is only ever decrypted for someone who has proved they control an address you listed. That single choice is what gives you the rest:

You can revoke it. Because the content was never delivered anywhere, killing the record kills the link. Sent a contract to the wrong address? Revoke it, and it stops opening – including for someone who already has the email sitting in their inbox. You cannot do that with normal mail.

It expires on its own. Links have a lifetime – two weeks by default, and you can set a longer one up to 90 days. Nobody has to remember to clean anything up.

Only the people you named can open it. The recipient list is an allow-list, and membership is re-checked every single time the page is used, not just at the first unlock. Forwarding the link to a colleague does not work – they can request a code, but it will not be sent to an address you did not list. And because that check happens on every request rather than once, removing someone takes effect immediately, even mid-session.

There is nothing to intercept along the way. Mail passes through several servers between you and your recipient. With an encrypted message there is no content in transit to capture – only a link, which is useless to anyone who cannot also receive a code at an allow-listed address.

A few smaller details that matter in practice. The six-digit code is valid for 15 minutes, can only be used once, and only survives a handful of wrong guesses before it stops. You can see when each recipient opened the message. And if you send one message to three people, you get three separate private conversations – the recipients cannot see each other’s replies, or even that anyone else received it.

This is the same idea as the encrypted-message feature large enterprises pay for in Microsoft 365, and it is included with your mailbox.

The AI features, and what they actually do#

This is the part we would ask you to read carefully, because “AI email” means a lot of different things and most of them are vague.

There are two features, and both are off by default. Nothing from a mailbox is sent anywhere for AI processing unless you switch it on yourself, per mailbox, from the control panel. A mailbox you never enable has never had a single message leave our servers for this.

When you do switch it on, we tell you plainly what happens: the content of the messages being labelled or summarised is sent to Anthropic, our AI provider, and processed on their systems. You confirm that you have read it before anything is enabled. Turning it back off is a single click, takes effect immediately, and never asks you to confirm anything – withdrawing should always be easier than agreeing.

Triage: labelling what you actually need to do#

Triage reads new mail in your inbox and labels each message by what it needs from you:

• Needs reply – someone is waiting on an answer from you
• Follow-up – something you will need to come back to
• FYI – worth knowing, no action needed
• Newsletter – bulk mail you subscribed to

The useful distinction here is that it labels by intent, not topic. Plenty of tools sort mail into categories like “work” or “travel”. That tells you what a message is about, which you usually already know from the subject line. What you actually want to know when you open a full inbox is which five of these forty messages are waiting on you. That is what triage answers.

Two design decisions we think are worth stating:

It never moves your mail. Everything stays in your inbox. The label is applied as a standard IMAP keyword, which means it is non-destructive and completely reversible. If you switch the feature off, the labels are just flags you can ignore or clear – no message has been filed away somewhere you will not find it. We have all lost an important email to an over-eager filter, and we were not willing to build that.

The labels show up in your other mail apps too. Because they are standard IMAP keywords rather than something invented that only works in our webmail, other mail clients can see them. You are not locked into our interface to benefit from it.

New mail is labelled automatically in the background while you are signed in.

Summaries: the gist of a long email#

Open a long email and you can ask for a summary of it. That is the whole feature – no automatic rewriting of your mail, no AI-generated replies sent on your behalf.

Two things worth knowing. First, each message is summarized once, ever. The result is stored, so re-opening the same email returns the summary you already have rather than costing another AI call. Second, you can choose the language of the summary. Set it to match the email, so a German email gets a German summary, or fix it to your own language and get an English summary of that German email. If you deal with mail in a language you read slowly, that second option is the one to try.

What the AI does not do#

It does not send mail for you. It does not delete or move anything. It does not read your mail when the feature is off, and it does not read mailboxes other than the one it is enabled for. Summaries happen when you ask for one, on the email you opened.

How to switch it on#

1. Sign in to your Hostney control panel.
2. Open Email and choose the domain you want mail for.
3. Follow the setup page – it will publish your DNS records or hand you the exact values to paste, and check them for you.
4. Create your first mailbox.
5. Open webmail, sign in, and turn on two-step verification while you are there.
6. Adding your phone or desktop mail app? Create an app password in webmail under Settings first, and use that instead of your password.
7. Sending something sensitive? Compose it as an encrypted message – the recipient needs no account, just the code we email them.

Want the AI features? Open the mailbox’s menu in the control panel, choose AI features, and pick the ones you want. They are off until you do, and off again the moment you say so.

Email is the account that all your other accounts are recovered through. It is worth running it somewhere you control, on a domain that is yours, with the security switched on. That is now one page in the panel you already have open.

The full feature list lives on the email hosting page, and webmail is at mail.hostney.com — also in the Log in menu at the top of this page.