Shutbox

Spec sheet

Product

Shutbox is a private email service that is currently in beta.Read 9 Oct 2026 · shutbox.im

API

The API uses JSON over HTTPS, and API-key creation is available on paid plans.Read 9 Oct 2026 · shutbox.im

Support

Dedicated support is included with the Business plan; the security policy says Shutbox is run by one person and does not currently pay vulnerability bounties.Read 9 Oct 2026 · shutbox.im

Account security

The service supports OPAQUE authentication, optional TOTP two-factor authentication, and WebAuthn passkeys.Read 9 Oct 2026 · shutbox.im

Custom addresses

Users can bring their own domain or start with an @shutbox.im address and use aliases.Read 9 Oct 2026 · shutbox.im

Data location

The privacy policy says mail and account data are stored in Nuremberg, Germany, with encrypted database backups in Germany.Read 9 Oct 2026 · shutbox.im

Domain setup

Shutbox provides MX, SPF, DKIM, and DMARC records for users to publish with their DNS provider.Read 9 Oct 2026 · shutbox.im

External mail

Outbound mail to other providers is decrypted in memory by a delivery bridge for transmission, while sender, recipient, and timestamp metadata remain unencrypted.Read 9 Oct 2026 · shutbox.im

Inbox features

The web inbox includes folders, labels, conversations, and search.Read 9 Oct 2026 · shutbox.im

Internal encryption

For mail between Shutbox accounts, message bodies and attachments are encrypted on the sending device for each recipient.Read 9 Oct 2026 · shutbox.im

Mobile app

The security disclosure policy lists the Shutbox Android app within its scope.Read 9 Oct 2026 · shutbox.im

Storage limit

When an account exceeds its storage quota, outbound sending is suspended and inbound mail continues for a 30-day grace period.Read 9 Oct 2026 · shutbox.im

Plans and prices

Every Shutbox plan and price →

Where Specifiction places it

• Private Email Services#19 of 297.8