Send emails as usual. Certidox certifies them automatically.
Install the Certidox Mail Proxy Server within your organization and connect it to your existing email platform. Once configured, outgoing emails are certified automatically while employees continue using their usual mail applications.
Deploy on your own Linux infrastructure, then connect Microsoft 365, Google Workspace (Gmail), or another provider using SMTP and IMAP configuration.
Confidential by design · Independent verification · No change in your workflow
Start with the six setup stages below: deploy the Mail Proxy Server using Docker or a manual Linux installation, connect it to your existing email service, configure routing and invite users. Once their accounts are activated and approved, their outgoing emails can be certified automatically. Detailed Docker and authentication-key instructions are provided in the first stage.
01
Install the proxy server
Choose Docker or a manual installation on a Linux server managed by your organization. The setup screen lists administrator access and internet connectivity as requirements.
Choose Docker deployment or manual installation within your infrastructure.Select the image to inspect the original full-size screenshot.
Docker installation details
After choosing Docker, the platform guides you through checking Docker Engine 24 or later, logging in to the Certidox container registry, generating an authentication key in your browser, saving it in a protected .env file, starting the SMTP proxy with --env-file .env, and configuring its DNS hostname. The platform then carries the generated key into the next setup stage, Connect proxy. The example requires TCP ports 587 and 443, as shown in the installation screen.
Keep the generated authentication key private
The registry login command prompts for the password; it is not included in the command line. Generate the proxy authentication key in the Certidox setup, then copy the provided AUTH_KEY=... line into a server-side .env file and restrict access to that file with chmod 600, as shown below.
The Docker command loads the key using --env-file .env; it is no longer retrieved from docker logs. Do not publish the .env file, store it in version control or include the real key in screenshots. Restrict server and Docker administrator access because environment variables can remain accessible to administrators.
Updated Certidox installation screen. The authentication key is generated in the browser, saved to a protected .env file and passed to the SMTP proxy at startup. No authentication key is shown in this capture.Select the image to inspect the original full-size screenshot.
Enter the configured proxy hostname, such as smtp-proxy.your-company.com. The authentication key created in the Docker installation stage is automatically filled in by the platform. Use Test and connect to check the connection.
Enter the proxy address; the previously generated key is automatically filled in. Then test the connection.Select the image to inspect the original full-size screenshot.
03
Choose the email platform
Select Microsoft 365, Google Workspace (Gmail), or another email platform using its SMTP/IMAP configuration.
The platform selector supports Microsoft 365, Google Workspace and other providers.Select the image to inspect the original full-size screenshot.
04
Configure email routing
For Microsoft 365, enter the business email domain and follow the relay configuration for that provider. Google Workspace and other providers follow their respective setup paths.
Microsoft 365 routing example with an editable business domain.Select the image to inspect the original full-size screenshot.
05
Invite your users
Upload TXT or CSV email-address lists, review the invitation message, confirm the intended users, and send activation invitations. The provided workflow specifies a maximum of 500 addresses per uploaded file.
Prepare and authorize invitations from the platform.Select the image to inspect the original full-size screenshot.
06
Track account activation
The administrator can see how many users have activated and how many invitations are pending. A user’s automatic certification starts after account activation and administrative approval.
Completion screen showing example activation and pending-invitation counts.Select the image to inspect the original full-size screenshot.
After setup: manage user accounts
In Manage accounts, administrators can review roles, account status and SMTP proxy enablement, and manage certification access for users.
Actual Manage accounts screen showing user roles and SMTP proxy enablement.Select the image to inspect the original full-size screenshot.
Once the proxy is connected and users are activated, employees can continue sending emails as usual. Certidox handles certification automatically.
This real Certidox demonstration shows a message composed in Outlook by Rémy Eisenstein (remy@certidox.com) to Daniel Reed's demonstration mailbox (daniel.reed.demo@outlook.com). A two-page Certidox overview PDF is attached. The sender uses Outlook as usual; the configured Mail Proxy Server certifies the outgoing email automatically.
1. Write the email and attach the PDF
The message has the subject Certidox Overview for Your Review. The attached PDF also has its own Certidox certification and QR code, separate from the email's certification. No extra certification action is needed in Outlook.
The original Outlook draft, with its two-page PDF attachment and the message before automatic email certification.Select the image to view the original full-resolution capture.
2. The recipient sees the certified email
The delivered-view screenshot shows the message in Outlook with its PDF attachment, a Certidox certification notice and a Certidox QR code inserted into the body. The recipient can open the verification record before relying on the message.
Actual demonstration email as displayed in Outlook. The email QR code and the PDF’s separate certification should be checked independently.Select the image to view the original full-resolution capture.
Scan the QR code using the free Certidox app. In this demonstration, the verification result identifies Rémy Eisenstein as certifier, CERTIDOX as the organization, daniel.reed.demo@outlook.com as the email destination, the subject and certification date. The green Document VALID result reflects the status when the screenshot was taken, not a live check today.
1. Scan and check the certification
Confirm that the recorded certifier, organization, recipient, subject and time match what you expect. Check the current certification status with a fresh scan.
Certification result, October 20, 2026, 4:33:24 AM CDT. The status can subsequently change.Select to enlarge.
→
2. Tap “View document” and compare
Open the structured reference for the certified email. Review the From, To, subject, message text and recorded attachment information. Scroll through the reference and compare the complete content with the email received.
Certified email reference. This capture shows the beginning of the message and the attachment entry; scroll for the full reference.Select to enlarge.
Verify the sender. Check the live status. Compare the complete certified reference with the message you received before relying on it.
Email and attachment are separate. Certidox's certified email reference is a structured representation of selected message fields and body content, not a byte-for-byte copy of the original .eml. It may record an attachment's filename and metadata, but does not reconstruct the PDF's bytes. The PDF in this demonstration has its own Certidox QR code and should be checked separately.
Screenshots are from October 20, 2026. A fresh verification is required to establish the current status.
Manage Status After Sending
The My documents dashboard records this email under Certidox Overview for Your Review, with type Email and Active status at the time the screenshot was taken (October 20, 2026, 4:33 AM CDT). The sender can subsequently manage its certification status without altering the certified historical reference.
Actual Certidox dashboard row. Select to zoom in on the timestamp, type, status and available actions.Select the image to view the original full-resolution capture.
The sender can revoke a certification after sending the email. If the organization chooses to notify previous verifiers, they can receive real-time alerts when status changes. Revocation does not erase or recall an email that has already been delivered.
The screenshot shows a historical Active state, not the current state.
Independent Verification Bundle
The actual evidence bundle for the email to Daniel Reed is available below. It allows a third party to reconstruct the certified email-content representation, check its SHA-256 integrity and independently examine the RFC 3161 timestamp evidence, without relying exclusively on the Certidox verification display.
Original Certidox bundle download confirmation for this same demo email, with its SHA-256 fingerprint.Select the image to view the original full-resolution capture.
SHA-256 of the downloadable original ZIP (matches the screenshot)e92e6b868da733b082e957c3e02aaea523e4418214c50aad33b549dfd25e58b3
The ZIP is supplied unchanged from the browser download. Its SHA-256 matches the screenshot above. The included reading key allows reconstruction of the demonstration email's certified representation. Use this bundle only as an intentionally shared sample.
What is inside?
Encrypted certified email representation:document.enc, with reading_key.txt for decryption.
Certification manifest:manifest.json, identifying CERTIDOX, the certifier, the certification event and the payload SHA-256.
Reproducibility tools:readme.txt, decrypt.py and verify_timestamp.sh.
How to independently verify
Decrypt the certified email representation using the supplied reading key.
Recalculate the SHA-256 of the resulting document.json and compare it with payload_sha256 in manifest.json.
Verify the RFC 3161 timestamp response against the exactmanifest.json bytes and independently authenticate the TSA signature and certificate chain.
Check the timestamp trust chain independently
The supplied verify_timestamp.sh may download a DigiStamp certificate bundle as a convenience. A successful download does not by itself establish that the downloaded certificates are trusted. Independently validate the DigiStamp root certificate fingerprint and chain before accepting the result as evidence.
What this proves and what it does not. The bundle supports examination of the historical certified email representation and timestamp. It does not establish email delivery, receipt, reading or current certification status. The attached PDF is a separately certified document, not a file reconstructed from this email bundle.
The Certidox Mail Proxy Server encrypts the email-content representation it certifies inside your organization, before protected data reaches Certidox infrastructure.
No readable email content is processed or stored on Certidox servers, and no decryption keys are stored there.
The organization can keep its current mail clients and let recipients independently verify certification records, while technical reviewers can examine the historical evidence bundle.
Certidox automatically certifies outgoing business emails through an organization-hosted Mail Proxy Server. Each Certidox-certified email includes a QR code that recipients can use to inspect the certification record and compare the exact certified email content.
Do employees need to change how they send emails?
No. Employees continue using their existing email applications. The Certidox Mail Proxy Server certifies eligible outgoing messages automatically once their accounts are activated and approved.
Which email platforms are supported?
The setup supports Microsoft 365 and Google Workspace (Gmail), including custom-domain mailboxes, plus other providers configured using SMTP and IMAP.
Can the Certidox SMTP Proxy Server be installed with Docker?
Yes. The setup offers both Docker and manual Linux-server installation paths. The organization hosts and administers the proxy.
What does a recipient verify after scanning the QR code?
The recorded certifier and sender, destination, subject, certification date and current certification status. Selecting View document reveals the structured Certidox-certified email reference for comparison.
Does Certidox preserve the original .eml file and attachments?
The downloadable Certidox-certified email reference is a structured representation of selected email fields and message content. It is not a byte-for-byte copy of the original .eml, and attachment contents are not reconstructed; attachment metadata may be included.
Can a sender revoke a Certidox-certified email after sending?
Yes. Its certification status can change after distribution. Eligible previous verifiers may receive an alert when notification is enabled. Revocation does not recall or erase the email already delivered.
Does the verification bundle prove that an email was delivered?
No. The bundle supports independent checks of the historical integrity of Certidox-certified email content and timestamp evidence. It does not itself prove delivery, receipt or reading, or determine the current live certification status.
Is a Certidox-certified email stored in readable form on Certidox servers?
No. The certified email-content representation is encrypted within the organization. Certidox servers do not process or store readable email content or decryption keys.
Certify Outgoing Emails Automatically
Keep your current email workflow, give recipients access to independently verifiable certification records, and retain control of certification status after sending.
