End-to-end encrypted, on the domain you own

Mail that belongs to you, not to an ad network

Darkgram runs the mailboxes on darkgram.com: conversation mail, encryption that happens in your browser, and search that finds anything — with nothing reading your messages on the way through.

Create your mailbox Sign in

You will need a domain you can add a DNS record to.

has:attachment from:kristina

Kristina LindqvistQ3 board pack3— Draft attached — numbers are final, deck copy is not.09:41
security@Signing key rotated— The new public key is published at the well-known path.08:12
Tomas, AyaRe: DNS cutover window6— MX records propagate quickly, but let us keep the old host warm.Yesterday
AccountsInvoice 2043 paid— Receipt for September attached. No action needed.Yesterday
Jonas WeberMailboxes for the new starters2— Four addresses, one alias each, all on the marketing domain.Tue
Lena FischerShared the audit folder with you— Everything from the last review is in Drive now, not in my outbox.Tue
postmaster@DMARC report accepted— All mail from the domain passed alignment for the reporting window.Mon
Aya NakamuraKeys for the contractors4— Their clients found our public keys in the directory without asking.Mon

Everything a working mailbox needs

A mail client, the storage beside it, and the console that runs the domain underneath — one account, not three products stitched together.

Mail that reads like mail

Conversation threading, labels, attachments and keyboard shortcuts, with SPF, DKIM and DMARC results shown on every message and remote images held back until you ask for them.

End-to-end encryption

OpenPGP keys are generated in your browser and never leave it. Mail is encrypted and signed before it is sent, as PGP/MIME, so other clients can read it — and a Web Key Directory publishes your public key so they can find it.

Your domain, your addresses

Sign up with an address on a domain you control, prove it with a single DNS record, and every mailbox and alias on that domain is yours to hand out.

Drive alongside the inbox

Folders, sharing, trash and quotas. Uploads go straight from the browser to storage with a presigned URL, so large files never queue behind the app.

An admin console, not a support ticket

Add domains and get the exact DNS records to publish, watch delivery verification turn green, create mailboxes and aliases, and read back every change in an audit log.

Search that finds it

Gmail-style operators — from:, has:attachment, before: — over a full-text index, with a meaning-based mode when the semantic backend is configured.

Encryption

The server holds ciphertext it cannot open

Encryption is not a setting applied after the fact. Your key pair is created in the browser and the passphrase never leaves it, so a message is sealed before it reaches the network — and stays sealed in storage, in backups, and in anything anyone later subpoenas.

Keys are generated and unlocked in the browser; the server stores ciphertext it cannot read.
Encrypted mail travels as PGP/MIME, so recipients on other clients open it normally.
A Web Key Directory serves your public key, so senders can encrypt to you without asking.
Passwordless sign-in with the key on a device that already remembers it, and optional two-step verification by SMS.

Keys in the browser

Generated on your device, unlocked by a passphrase only you hold.

PGP/MIME on the wire

Standards, not a walled garden — any OpenPGP client can read it.

Authenticated senders

SPF, DKIM and DMARC results shown per message, not hidden in headers.

Live, without polling

Changes are pushed to open tabs the moment mail lands.

Your domain

One domain, every mailbox on it, run by you

Whoever proves control of a domain administers it. Add addresses and aliases, set quotas, watch delivery verification, and read back every change anyone made. Operators see the whole server; domain administrators see their own domains and nothing else.

Mailboxes

Create, suspend and remove addresses on your domain.

Aliases

Point extra addresses at an existing mailbox.

DNS

The exact records to publish, with live verification status.

Audit log

Who changed what, when, and from where.

Three steps to a working address

1
Claim your domain
Sign up with the address you want on a domain you already own. No mailbox exists yet — you are claiming the name.
2
Publish one record
Add the TXT record shown to you to prove control, then the sending and receiving records the console hands you.
3
Open the inbox
Mail starts flowing, you become the domain's administrator, and you create mailboxes for everyone else.

Put your mail somewhere you control

Claim your domain, publish a record, and hand out the first address today.