DMCN replaces email's 1982 trust model with cryptographic identity: a message from an unverified sender is never delivered, and a message from a verified sender cannot be forged. Mail between DMCN inboxes is encrypted before it ever reaches us, and the account keys stay with your organization, never with us.
lost to business email compromise in 2025 alone — roughly $123,000 per reported incident.
of unwanted email technically passed SPF, DKIM and/or DMARC. Authentication verifies domains — it has never verified people.
of 81.6 million real emails were end-to-end encrypted, in the largest study ever done. Pushing key custody onto end users killed every previous attempt.
The tools you already pay for filter fraud. They cannot make it impossible — the protocol underneath has no idea who anyone is. That is the part we replaced.
Every DMCN message carries its sender's cryptographic signature, verified before delivery. Impersonating a colleague isn't detected and filtered — it's structurally impossible. Mail from outside the network arrives with its SPF, DKIM and DMARC verdict shown rather than silently computed, so you can see exactly what was checked.
Mail is end-to-end encrypted, and on a managed domain your own administrator — not us, not each employee — is the custodian. A lost laptop or a departure is recovered by your org in minutes. We can't read mail between DMCN inboxes.
The bridge keeps you emailing Gmail, Outlook and every legacy address from day one, with SPF, DKIM and DMARC alignment handled for you. Mail between DMCN inboxes is always end-to-end encrypted.
You keep your own DNS as the trust root, and consent is mutual and revocable. We hold no zone and no account keys, and we act on your domain only within the authority your signed record grants.
Encrypted email failed for 25 years because key custody was dumped on end users. On a managed domain, your administrator is the custodian — never each employee, and never us. The provider can't read mail between DMCN inboxes; your organization can always recover it.
Publish one DNS record to prove the domain is yours, then your mail records when you want legacy mail bridged. Your DNS stays the root of trust — we never touch your zone.
Your domain authorizes us to serve it; our fleet accepts your domain. Two explicit cryptographic consents — either side can revoke.
Your admin mints each mailbox and pairs employees' devices with a short verification code. Keys stay inside your organization.
Legacy mail flows through the bridge with authentication alignment handled for you. Mail between DMCN inboxes is end-to-end encrypted from the first message.
Your DNS stays the root of trust, and consent is mutual and revocable. That's not a contract clause — it's the architecture.
Why sovereignty buyers pick DMCNYes — that's what the bridge is for. Your team keeps emailing every normal address from day one, and we handle SPF, DKIM and DMARC alignment on outbound so your mail lands in inboxes. Every counterparty who adopts DMCN upgrades that channel to end-to-end encryption automatically. You buy it for what it does inside your organization today; the network effect is upside, not a prerequisite.
That's the headline feature, not the fine print. On a managed domain your admin custodies the keys: a lost laptop is re-paired in minutes, and offboarding is a rotation that locks every device the departed employee holds out of the mailbox immediately. This is exactly the key-management problem that sank S/MIME and PGP — DMCN was designed around it.
Not mail between DMCN inboxes: it is encrypted on your devices, and our servers hold no account keys, not even encrypted copies. Mail to and from ordinary addresses passes through our bridge, which handles it in plaintext to translate it, and our relays see delivery metadata such as who wrote to whom and when. On a managed domain your own administrator can recover accounts; we never can.
No, and we won't pretend otherwise. Mail crossing the bridge to legacy email is protected in transit (TLS), like all email today — that's the floor, never the ceiling. Mail between DMCN inboxes never touches the bridge and is always end-to-end encrypted. If you want us out of the trust path entirely, you can run your own bridge.
Every message is signed at composition — tamper-evident and non-repudiable, which is stronger evidence than ordinary email. Admin key custody answers recovery; for retention, encrypted archive-on-send to an organization archive key is designed and on the roadmap, and design partners shape it. We'll be straight with you about what's built versus planned.
The protocol is open and identity records are self-certifying: your keys and your domain stay yours, and any operator running the open protocol could serve them again. Mailbox export is being built; until it ships, stored mail lives on our relays. Learn more about the protocol