Mail: connect your accounts in pulpInbox

pulpInbox reads and sends messages from your usual accounts (Gmail, Outlook.com, Microsoft 365 or any other provider). A browser can't reach your provider's servers on its own: pulpInbox relies on your pulpSuite installation's mail bridge. On online pulpSuite, you can turn on end-to-end encryption (beta) for each account: the bridge then simply relays an encrypted connection between your browser and your mail server (see below). Your administrator must have started it.

Without the bridge, you can still open and import saved messages (.eml, .msg, .mbox, .pst…) and use the calendar and contacts on your device. See the pulpInbox help.

Until an account is linked, pulpInbox shows a sample mailbox marked Example: its Link an account button opens the same window as Add an account, and the example disappears as soon as your account is linked. Nothing is ever sent from the example.

On online pulpSuite: pulpSuite account and limits

When you use pulpSuite on an online server, mail is reserved for people signed in to their pulpSuite account. Without a signed-in account, pulpInbox shows “Sign in to your pulpSuite account to read your email here” and an Open my account button. Once you're signed in, come back to pulpInbox: mail picks up again on its own. The local mailbox, calendar and contacts on your device don't need an account.

• Your mail password is only used to open the session. It is never stored, neither on the server nor in your browser: it stays in the page while the page is open. If you close or reload it, you need to type it again.
• Instant delivery. New messages in your inbox appear the moment they arrive, with nothing to refresh. If your provider doesn't support this, pulpInbox checks the mailbox every 5 minutes, as long as the page is open. The Refresh button at the top of the list is still there, at most once a minute.
• Usage limits, to protect the service and your accounts (your administrator can adjust them):

When a limit is reached, pulpInbox tells you and says how long to wait. With end-to-end encryption, sending limits are applied by pulpInbox in your browser, since the pulpSuite server no longer sees your messages. Refused passwords are then limited by your provider itself.

• Servers that can be reached. From an online server, only public mail servers are reachable, on their usual ports (incoming 993 or 143, outgoing 465 or 587, calendars 443). A mailbox located on your computer or on your local network (for example one served by a mail program that connects locally) can't be reached.
• Install the bridge on your computer. For a mailbox on your network, or to avoid depending on any online server, you can run the pulpSuite bridge on your own computer (see “For administrators” below). It then requires no pulpSuite account and applies no usage limits, and your exchanges with your provider no longer go through the online server.

End-to-end encryption (beta)

This feature is on trial and off by default. To turn it on, tick End-to-end encryption (beta) in the add-account window or in the account window (for a password account, the option applies to the next connection; a Google or Microsoft account reconnects right away). Without it, the connection goes through the pulpSuite server, which sees your password and your messages for the length of the session, without storing them.

With the option, on online pulpSuite, your browser opens the encrypted connection with your mail provider's server. The pulpSuite server passes this connection along without being able to open it: it sees neither your password, nor your messages, nor your recipients.

• What the pulpSuite server sees: your pulpSuite account and IP address, the name of the mail server reached, the amount of data exchanged, and the time and length of the connection. That is all its log contains, kept for 30 days.
• The security certificate of the mail server is checked by your browser: server name, validity dates and the authority that issued it. If it isn't valid, pulpInbox refuses the connection before sending anything (“Connection refused: your mail server's security certificate is not valid”). Then check the server name in the account settings.
• Providers tried (October 2026): Gmail, Outlook and Microsoft 365, Yahoo, iCloud, Orange, Free, Infomaniak, Gandi, Ionos, Hostinger, Zoho and GMX accept it, for both incoming and outgoing mail; La Poste for outgoing mail only, OVH for incoming mail only; not SFR yet. For the others, pulpInbox offers you the usual connection.
• Where to see it: the account window says End-to-end encrypted to your mail server or Goes through the pulpSuite server, and a small padlock follows the name of encrypted accounts in the folder list.

What still goes through the pulpSuite server, which reads it for you:

• Connected calendars (.ics link and calendar server). For a calendar opened “from a mail account”, that account's password is passed to the pulpSuite server for the calendar.
• A mail server that doesn't accept this encryption from the browser (older servers). pulpInbox tells you and offers Go through the pulpSuite server: nothing changes without your consent. The choice is remembered for that account; to try again later, open the account window, type your password and click Try end-to-end encryption again.
• Signing in with Google or Microsoft: the pulpSuite server keeps the authorization (encrypted) and gives your browser a temporary access key, valid for about an hour. Your messages themselves stay end-to-end encrypted.

Add an account with a password

This works with most providers.

1. In pulpInbox, click Add an account.
2. Enter your email address, display name and password.
3. pulpInbox works out your provider's settings from the address. If the connection fails, check the IMAP server (incoming), the SMTP server (outgoing), the ports and the username given by your provider.
4. Click Connect.

The password is only used to open the session. It is never stored: the session closes when you disconnect, when you close or reload the page on online pulpSuite, or after about two hours of inactivity with the bridge installed on your computer; you then need to type the password again.

Sign in with Google or Microsoft

For Gmail and Microsoft accounts (Outlook.com, Hotmail, Microsoft 365), pulpInbox offers Sign in with Google and Sign in with Microsoft, without typing a password into pulpSuite.

1. Click your provider's button. A sign-in window opens on the provider's site.
2. Sign in and accept the requested access.
3. Go back to pulpInbox: the account appears once sign-in is complete.

No password is stored in pulpSuite.

On online pulpSuite, your messages stay end-to-end encrypted all the way to Google or Microsoft (see above).

After that:

• When you reload the page, the session reopens on its own, without asking you anything.
• Needs reconnecting (orange icon): the authorization has expired or been withdrawn. Open the account and click Reconnect with Google or Reconnect with Microsoft.

Remove this account closes the session and deletes the authorization the bridge was keeping. With Google, the authorization is revoked as well. With Microsoft, remove pulpSuite from your Microsoft account's app permissions if you want to cut access on the provider's side. Your messages stay on your provider's server.

Connected calendars

Calendars go through your installation's bridge, which reads them for you (they don't benefit from the end-to-end encryption of mail):

• .ics link: a read-only subscription to a calendar address (.ics or webcal://) that refreshes on its own.
• CalDAV server: two-way sync with a calendar hosted by a compatible provider.
• Google Calendar and Outlook: two-way sync isn't available yet. In the meantime, subscribe to your calendar's secret address (read-only).

For administrators

To enable Google and Microsoft sign-in, you need to:

1. register pulpSuite as an app with Google (Google Cloud Console) and with Microsoft (Microsoft Entra admin center), using the bridge's redirect address;
2. give the bridge a secret (the INBOX_BRIDGE_SECRET variable, at least 16 characters) that protects the saved authorizations, plus those apps' credentials.

The full steps are in the project's docs/messagerie-oauth.md document.

To publish the bridge on a server open to the Internet, start it with INBOX_BRIDGE_PUBLIC=1: it then requires a pulpSuite account token on every request, refuses any server on the internal network and applies the limits above (adjustable with the INBOX_LIMIT_… variables, listed at the top of servers/inbox-bridge/server.mjs). It keeps a minimal log (date, IP address, account, event: never a password, message content or recipient address), kept for 30 days. The deploy/vps/install-inbox-bridge.sh script prepares this installation.

In this mode, accounts that turned on end-to-end encryption (beta) go through the bridge's /api/mail/tunnel route: the browser opens the encrypted connection with the mail server itself, and the bridge only relays encrypted data (ports 993 and 465, or 143 and 587 if the browser sets up encryption before any credential; otherwise the connection is cut). The web server must let this route through without buffering and with long timeouts (deploy/vps/nginx-pulpsuite.conf). The limits of these connections are set with the INBOX_TUNNEL_… variables. If the browser can't open the encrypted connection itself, pulpInbox goes through the bridge and says so.

Good to know:

• A Google app left in “Testing” mode only lets declared test users in, and the authorization expires after 7 days: the account then shows Needs reconnecting, and one click is enough.
• In Microsoft 365, sending requires the “authenticated SMTP” option to be allowed for the mailbox, which is often turned off in organizations: without it, receiving works but sending fails.

Frequently asked questions

“The mail connection service isn't responding.”

The bridge isn't running, or pulpSuite can't reach it. Let your administrator know: it's up to them to start it (see the note for administrators above). In the meantime, the local mailbox still works.

“Username or password rejected.”

Check the password, then the username and servers. If your provider requires an app password, create one and use it instead of your usual password.

“Your mail server doesn't accept an end-to-end encrypted connection from the browser.”

Your provider uses an encryption method that is too old for the browser. You can click Go through the pulpSuite server: the pulpSuite server will open the connection for you and see your password and your messages for the length of the session, without storing them. Or install the bridge on your computer. To go back to end-to-end encryption later: Try end-to-end encryption again in the account window.

“Connection refused: your mail server's security certificate is not valid.”

The server reached doesn't prove that it really is your provider's (different name, expired certificate or issued by an unknown authority). Check the incoming and outgoing server names in the account settings. If the name is right, let your provider know: for your safety, pulpInbox doesn't offer to skip this check.

“The browser blocked the sign-in window.”

Allow pop-ups for pulpSuite in your browser settings, then try again.

“You signed in as … instead of …”

When reconnecting, sign in with the account that needs reconnecting, not another account at the same provider.

Can I open a .msg file without Outlook?

Yes. pulpInbox opens .msg and .eml messages with no bridge and no account: open the file or drop it into pulpInbox.