Zorlya Mail is where a person reads what you write to support@zorlya.com or privacy@zorlya.com. It is the webmail app we built for company addresses, and it runs at mail.zorlya.com. This post describes how an address becomes a mailbox, how reading and sending work, how the picture beside a sender gets there, and what leaves our server when it does.
Who it is for
Zorlya Mail is not an inbox you sign up for. Mailboxes are created by an administrator in the admin console, and a mailbox owner signs in with a mailbox login and a password, which are separate from a job seeker or employer account. A forgotten password is reset by an administrator. There is no self-service reset form, so the administrator either hands over a generated password or sends a one-time link to a recovery address. That link works once and expires after 30 minutes.
If you use Zorlya as a job seeker, you will never see this app. What matters to you is what happens to a message you send us.
How a message reaches a mailbox
- You send mail to an address at zorlya.com.
- Cloudflare Email Routing hands the message to a small worker, which saves the whole message with its attachments in a private bucket stored in the European Union. The bucket has no public address.
- Our platform reads the message into the database: who sent it, who it went to, the subject, the text, the thread it belongs to.
- If saving fails, or a mailbox is set to forward, a copy goes to an inbox we own at Google. Google then holds that copy under its own terms.
Only people who were given access to a mailbox can read it. Opening an attachment or a raw message is recorded in that mailbox’s event log. Trash and Spam are emptied after 30 days, and a deleted mailbox is emptied after 30 days as well. The privacy policy has the full list of retention periods.
Reading mail
The app has the folders you would expect: Inbox, Starred, Sent, Drafts, Archive, Spam and Trash, plus labels you make yourself. Messages are grouped into threads. Search understands plain words and a few operators: from:, to:, label:, in:, has:attachment, after: and before:. Filters can label, archive, delete or mark mail as read as it arrives.
Mail from outside is treated as untrusted. The text of an HTML message is cleaned in the browser and shown in a sandboxed frame. Remote images are blocked with no override, so a message cannot report that you opened it. Links open through a page that shows the real address first and warns you when the link text names a different one. A file with a risky type asks before it downloads.
Keyboard shortcuts work on the list: j and k to move, Enter to open, c to compose, r to reply, e to archive. Press ? to see the full set.
Why are remote images blocked?
A picture in an email can be loaded from the sender’s server when you open the message. That request tells the sender that the message was opened, when, and roughly from where. Some senders use tiny invisible pictures for exactly this. Blocking remote images with no override means no message read in Zorlya Mail can do that, whoever sent it. The cost is that some marketing email looks plain. For mail that a support team reads, that is the right trade.
How to read a link before you click it
The link page in Zorlya Mail shows the real address before you go there. The same habit helps in any mail program:
- Hover over the link, or press and hold on a phone, to see the address.
- Read the domain from the right: in
https://login.example.com.attacker.net/, the site isattacker.net. - If the text of the link names one site and the address goes to another, do not open it.
- Type the address of a site you know yourself rather than following a link to sign in.
Sending
You write in plain text, with a small toolbar for bold, italic, a link, a bulleted list and a quote. The toolbar writes simple markers into the text, and the app builds the HTML version and the quoted reply from them. There is no full rich text editor, because an editor has to clean what you paste and plain text does not.
A mailbox can send only from an address its owner has been granted, chosen in the From field. A message is limited to 5 MB in total, and to 50 recipients. A draft saves on the server 10 seconds after your last change, so a closed window or a reload does not lose it. Replies go through Cloudflare Email Sending.
Pictures beside senders
Each mailbox owner can add a picture under Settings, then Profile. It must be a PNG, JPEG or WebP of at most 512 KB, and the browser crops it to a square before it is sent. It shows in the top bar, the mailbox switcher, the message list and the From line. Only people signed in to the mail app, and administrators in the admin console, can see it.
For a sender outside Zorlya, the app looks for a picture in this order and uses the first it finds:
- Their Gravatar.
- The brand logo their domain publishes, but only when the message passed its DMARC check.
- Their company’s logo, read from their own site.
- Their initials on a colour that stays the same for that address.
Addresses at free mail providers such as Gmail get the Gravatar lookup only, since a message from a Gmail address says nothing about a company.
What are DMARC and BIMI?
DMARC, defined in RFC 7489, lets the owner of a domain publish rules for how receiving servers should check mail that claims to come from it, and what to do when a check fails. BIMI builds on it. The BIMI group describes it as a way for an organisation to show its logo next to its messages, and the message must pass DMARC for the logo to show. That is why Zorlya Mail uses a brand logo only for mail that passed DMARC: without that check, anyone could send mail that wears a bank’s logo.
What leaves our server
Our server makes these lookups. Your browser makes none, so the sender never learns that you read their message, from where, or at all.
- Gravatar receives a SHA-256 hash of the sender’s address and our server’s IP address. It does not receive the address, the subject, the message or who is reading.
- For a brand logo, Cloudflare’s DNS service is asked for a record at the sender’s domain. The domain is visible to Cloudflare, which already carries our traffic.
- A company’s own site receives an ordinary request for its home page and icons from our server.
Answers are kept for 30 days when a picture was found and 7 days when not, and they are shared by everyone using the app. Each person has a switch under Settings, Profile called “Look up sender pictures”. When it is off, nothing is looked up for that person, and only pictures of our own mailboxes and initials show.
What happens to a message you send us?
If you email support@zorlya.com, the message is stored as mail and read by a person in Zorlya Mail. The ticket system has its own route for mail, but as far as our code shows it is not yet connected to the mail that arrives, so do not count on an email opening a ticket by itself. For a reference number and a status you can follow, open a ticket from the contact page or from your account. The post on support tickets explains how.
Limits
The picture you set is shown inside Zorlya Mail only. When you send a message, the recipient’s mail program draws its own picture for you, and nothing in our message can change that.
Mail forwarding rules are shown in the app but are not switched on, and we do not have a date for them.
Questions people ask
Can I get a Zorlya Mail address?
No. Mailboxes are for Zorlya’s own company addresses and are created by an administrator.
Does Zorlya read the email I send to support?
A person on the team reads it. Attachments and raw messages that are opened are recorded in the mailbox’s log.
Does the sender know I opened their message?
Not through Zorlya Mail. Remote images are blocked, and sender pictures are looked up by our server, not your browser.
Where is mail stored?
In a private bucket in the European Union, and in our database for reading. A copy goes to an inbox we own at Google only when saving fails or a mailbox forwards.
What we know and what we do not
We know how mail is stored, read and sent from the code and its documentation. We do not control how other mail programs show your messages or your picture, and we have not confirmed that an email to support becomes a ticket.