Email security - Casa Conect Docs

Casa Conect’s email runs on its own mail infrastructure in the EU: receiving, sending, and mail on your own domain. No third-party email service stores your correspondence.

Receiving mail

Reception and scanning

Every message is scanned for viruses and spam, and its sender authentication (SPF, DKIM and DMARC) is evaluated on arrival.

Verdicts are applied first

Before Casa Conect opens the message, the verdicts are checked. Mail that fails virus scanning, is clear spam, or fails DMARC on a domain that publishes a reject policy is dropped at this point. Hostile mail is never opened. Oversized messages are refused.

Routing

The recipient address decides where the message goes: a personal docs address, the organization’s agent address, or a verified customer domain. Reserved names such as postmaster, abuse, admin and security never route to an agent.

Sender gating

For agent mail, your sender rules decide whether the message is handled, held for a person or dropped.

Processing exactly once

A message is marked as handled only after it has been fully processed. If something fails midway, it is retried in full rather than half-processed.

How senders are authenticated

A message is attributed to a sender only when the From address is authenticated: either DMARC passes, or DKIM or SPF passes for a domain that aligns with the From domain. A pass for an unrelated domain does not count, which defeats the common trick of sending a forged From through a legitimately signed third-party service.

Verdict	Outcome
Authenticated, and a member or an allowed sender, and clean	Handled by the agent
Unknown sender, inconclusive authentication, automated sender, or an incomplete scan	Held for a person in Pending approval
Virus, clear spam, DMARC reject, or a blocked sender	Dropped, with no bounce

Three rules deserve emphasis:

Blocks always win over allows.
Incomplete scans fail closed. If scanning could not run, the message is held, even from a verified member.
Dropped mail is never bounced, so an attacker cannot use bounces to discover which addresses exist.

Sending mail

Outgoing mail is DKIM-signed and sent from the agent’s address, with SPF and DMARC aligned.
Mail to anyone outside your organization is always a draft approved by a person. See Approvals.
Before every send, the recipient is checked against a suppression list of addresses that hard-bounced or complained, which protects deliverability for everyone.
Every message carries a header identifying it as agent mail. This is how loops are prevented.

Loop and abuse protection

Risk	Protection
Two automated systems replying to each other indefinitely	Incoming mail that carries the agent marker, or that comes from Casa Conect’s own sending domains, is dropped
Auto-replies and out-of-office messages triggering work	Messages with standard auto-reply markers are held, not answered
Floods of mail	Senders who send unusually many messages are rate limited and held
Address enumeration	No bounces for dropped mail

Your own domain

When you put the agent on your own domain, Casa Conect provisions a signed sending and receiving identity, and you publish the records that prove control of the domain. See The agent’s email address.

Only subdomains are accepted. Apex domains are rejected, to protect your existing mail.
A domain can belong to one organization.
Verification must complete within 72 hours, or it expires and must be restarted with fresh records.

Email content and the agent

The body of an email is untrusted data. It is fenced and labelled as outside content whenever the agent reads it, and work started by email runs with a reduced set of tools. See Agent safety.

​Receiving mail

​How senders are authenticated

​Sending mail

​Loop and abuse protection

​Your own domain

​Email content and the agent