Mailfence Security: 2FA, Service Passwords and Connection History

Mailfence gives you good tools, but one detail is easy to miss: two-factor authentication protects only the web login. Email programs connecting over IMAP, POP or SMTP aren't covered, so they need their own protection.

1. Turn on two-factor authentication

1. Install a TOTP authenticator app on your phone. Any app based on the open TOTP standard works; Mailfence mentions Aegis, Ente Auth and 2FAS Auth as examples.
2. In Mailfence, go to Settings → Password and choose to set up two-factor authentication.
3. Scan the QR code with the app and enter the code it shows.
4. Generate your backup codes, download them and store them somewhere safe, away from your phone.

Each backup code works only once. When you've used them up, generate a new set.

2. Protect email-program connections

Two-factor authentication doesn't apply to SMTP, IMAP/POP, Exchange ActiveSync, CalDAV/CardDAV or XMPP connections. Mailfence's advice is to:

• Disable the services you don't use, and
• create service-specific passwords for the ones you do, under Settings → Account → Security: Services access. Once a service has its own password, it no longer accepts your web password. Each password is shown only once, so copy it straight into the program. If a device is lost, click Revoke for that password without touching the main one, and review the list regularly to disable services you no longer use.

The settings for each protocol are in Mailfence server settings.

3. Check your connections history

Click your account display picture and choose Connections history. It shows the five most recent connections for each service — web, SMTP-IMAP/POP, EAS and others — from the past 100 days, merging similar entries. (XMPP connections appear without an IP address, and successful two-factor web logins aren't listed.)

• Failed logins from an IP address you don't know mean someone tried to get in — change your password.
• Successful logins you don't recognise may mean the account is compromised — change your password, review service-specific passwords and contact support@mailfence.com.

4. A strong password and a working reset address

Mailfence recommends a unique passphrase. Change it under Settings → Account → Security. Keep your reset/notification address current, because it's the only way to reset a forgotten password — see resetting your Mailfence password.

5. Know what encryption covers

Mailfence's integrated keystore gives you control of your OpenPGP keys: import existing keys, generate a revocation certificate in case a key is ever compromised, and export your key pair at any time. If you read mail in a desktop program, export your keys to PGP-compatible software there — the program handles encryption with its own tools, not Mailfence's web encryption.