posted by VaelMail · 15 November 2026
Private Email Glossary: 31 Terms Explained
Plain-language definitions of the terms used in private email, from account numbers and aliases to DKIM, OpenPGP, TLS and zero-knowledge.
Private email has a lot of jargon. This glossary explains 31 terms in a sentence each, in alphabetical order, and says how VaelMail uses the ones that apply. Use it alongside the FAQ and the security model.
The terms
Account number: A random number that replaces a username and password. On VaelMail it has 16 digits.
Alias: An extra address that delivers into a mailbox you already have.
Receive-only alias: An alias that can receive mail but never send. VaelMail's aliases work this way.
Forwarding alias: An alias that passes mail on to a mailbox at another provider.
App password: A separate credential for one mail app, so your main sign-in is never typed into it.
Authenticator app: An app that makes a six-digit code that changes every 30 seconds, used as a second factor.
Backdoor: A deliberate weakness that lets someone bypass a system's protections.
Catch-all: A rule that delivers mail for every address on a domain. VaelMail custom domains do not have one.
Ciphertext: Data that has been encrypted and is unreadable without the key.
DANE: A way to publish the expected TLS certificate for a mail server in DNS, so senders can check it.
DKIM: A signature added to outgoing mail that lets the receiver check it came from the domain.
DMARC: A policy that tells receivers what to do with mail that fails SPF or DKIM checks.
E2EE: End-to-end encryption: only the sender and recipient can read a message.
Encrypted mailbox: VaelMail's optional setting that seals stored mail and the search index with a key only you hold.
Fingerprint: A short value that identifies a public key, used to check you have the right one.
IMAP: The protocol mail apps use to read and organise mail stored on a server.
KYC: Know your customer: identity checks a service performs before it lets you use it.
Metadata: Data about a message, such as dates, sizes and addresses, as opposed to its content.
MX record: A DNS record that says which server receives mail for a domain.
OpenPGP: A standard for encrypting and signing messages with public and private keys.
Passkey: A sign-in method using a cryptographic key on a device or security key, with no code to type.
Phishing: Tricking someone into entering credentials on a fake site.
Public key: The half of a key pair you share so others can encrypt to you or verify your signature.
Recovery code: A single-use code that lets you in if you lose your second factor.
SIM swap: Moving a phone number to another SIM, usually to intercept SMS codes.
SMTP: The protocol used to send mail, between mail apps and servers and between servers.
SPF: A DNS record listing which servers may send mail for a domain.
TLS: Transport encryption that protects a connection between two servers or between an app and a server.
TOTP: Time-based one-time passwords, the codes made by an authenticator app.
Warrant canary: A dated, signed statement renewed on a schedule, whose lapse signals that something may have changed.
Zero-knowledge: A design where the service cannot read your data at all. VaelMail does not claim this.
Where to go next
For how sign-in works without a password, read what an account-number login is. For how encryption layers differ, read end-to-end encrypted email explained. For aliases, read receive-only aliases explained. If a term here is unclear or missing, tell us on the contact page.
