Improved security for meil.no mail

In May 2026, security researcher and advisor Per Thorsheim highlighted several findings identified by Internet.nl.

After review, we implemented a number of improvements and confirmed that several previously reported issues have been resolved. As a result, the latest Internet.nl assessment shows a significantly improved score, rising from 73% to 83% compared to the original report.

No customer data exposure, service compromise or active security incident was identified. The findings relate to infrastructure hardening, resilience and adherence to modern Internet standards.

In particular, cryptographic settings on our backup mail infrastructure were updated to align with current recommendations. These changes were completed and scheduled for full production rollout on 2026-06-05.

The remaining items primarily relate to infrastructure hardening and adherence to modern Internet standards:

• RPKI / Route Origin Validation — We are continuing discussions with our upstream providers regarding ROA publication for relevant prefixes. RPKI helps reduce the risk of route hijacking and accidental route leaks on the global Internet.
• IPv6 Mail Infrastructure — Additional IPv6 improvements for mail transport remain planned as part of our ongoing platform modernization efforts.
• IMAP Security Considerations — IMAP remains widely supported across the industry, but the protocol does not natively support modern multi-factor authentication in the same way as web-based access. We continue to evaluate the balance between compatibility, usability and security when defining future access policies.