IncaMail for the Email Client (MGI)

Overview

IncaMail Mail Gateway Integration (MGI) allows organizations to connect their existing email infrastructure directly to the IncaMail platform. Once set up, users can send and receive secure IncaMail messages directly from their existing email client (e.g. Outlook) without major change to their daily workflow.

This article guides you through signing up for an MGI subscription and completing the technical setup via the self-service administration portal.

There are three main steps to set up IncaMail for your email client: signing up for a subscription, registering your administrator account and completing the technical setup.

Prerequisites

Before you begin, make sure the following are in place:

• Domain ownership: You must be able to verify ownership of the domain(s) you wish to integrate with IncaMail.
• Valid SSL certificate: Your mail gateway or mail server must have a valid SSL/TLS certificate. This certificate is used for mutual TLS authentication with the IncaMail platform. If your certificate does not support mTLS, please reach out to our support team for further assistance.
• SMTP on port 25: Your mail infrastructure must support SMTP via port 25 with TLS (STARTTLS). Ensure port 25 is not blocked by your firewall.
• Compatible mail system: IncaMail is compatible with all modern mail servers (e.g. Microsoft Exchange) and mail gateways (e.g. Cisco IronPort, Fortinet FortiMail, Proofpoint) that support mutual TLS authentication, enforced TLS, or domain security.

Step 1 – Register an Account

If you do not already have an IncaMail account, register one first. The email address used during registration will serve as the administrator account for your MGI setup.

👉 Register here: https://app.incamail.com/en/register

Step 2 – Sign Up for a Business Subscription

MGI functionality requires an active IncaMail for the Mail Client business subscription. A 30-day free trial is available with no commitment required.

👉 Sign up here: https://web.incamail.com/en/e-mail-encryption/incamail-for-the-e-mail-client

Step 3 – Determine Your Certificate CNs

The MGI setup requires the Common Name (CN) of the SSL certificate used by your mail gateway or mail server — separately for both the sending (outbound) and receiving (inbound) directions.

The easiest way to retrieve the correct CNs is to use the IncaMail MTA Check tool:

1. Send an email from each domain you wish to configure to: mta@check.incamail.ch
2. The content of the email does not matter - the tool inspects the connection properties automatically.
3. You will receive an automated reply containing the CN details for that domain.

Important: Send one test email per domain. If you are configuring multiple domains, each domain requires a separate MTA Check email sent from an address on that specific domain.

If you need help interpreting the MTA Check results, forward them to IncaMail Support and we will assist you.

Step 4 – Configure Your Domains in the MGI Portal

Once your subscription is active and you have the correct CNs, log in to the MGI administration portal using your administrator account:

👉 MGI Administration Portal: https://app.incamail.com/en/admin/mail-gateway-integration

Follow the steps in the portal to configure each domain:

1. Enter the domain name you wish to integrate.
2. Configure the outbound connection (sending) — enter the CN of the certificate used by your mail gateway when sending messages to IncaMail.
3. Configure the inbound connection (receiving) — enter the CN of the certificate on the mail server or gateway where IncaMail should deliver incoming messages. The receiving host is determined either via MX DNS lookup or can be specified as a static hostname.
4. Save the configuration.

Note: Each domain must be configured separately. For each domain, the correct CN must be specified for both directions (inbound and outbound) individually.

Step 5 – Begin Testing

As soon as a domain has been configured in the portal, you can begin testing immediately.

To test outbound sending: Send an email from your mail client to any recipient address with the .incamail.ch suffix appended, for example: recipient@example.com → recipient@example.com.incamail.ch

Specify the delivery type in the subject line:

• <c> — Confidential
• <p> — Personal
• <r> — Registered

To test inbound receiving: Ask a test sender to send an IncaMail message to one of your configured domain addresses and verify that it is delivered correctly to your mailbox.
 

Sending Methods

Once MGI is set up, users can send IncaMail messages in the following ways:

• IncaMail Outlook Add-in — available for Outlook desktop and Outlook in the browser. Allows sending directly from Outlook with a dedicated IncaMail panel. Download available at: https://support.incamail.com/hc/en-us/articles/23085517399314-Downloads
• Domain suffix method — works with any mail client (including Apple Mail, Gmail, etc.) by appending .incamail.ch to the recipient address and specifying the delivery type in the subject line.
• IncaMail Web Interface — available at https://app.incamail.com, accessible from any browser without any infrastructure changes.

How the MGI Connection Works

Understanding the flow helps with troubleshooting:

Outbound (your infrastructure → IncaMail):

1. Your mail gateway routes the message to IncaMail via SMTP/TLS on port 25.
2. The IncaMail platform authenticates your gateway using its SSL certificate (mutual TLS).
3. IncaMail encrypts the message and delivers it to the recipient.

Inbound (IncaMail → your infrastructure):

1. IncaMail delivers the incoming message to your mail gateway or mail server via TLS.
2. The mail gateway forwards the message to the internal mail server.
3. The recipient retrieves the message from their mail client.
   • Confidential messages are delivered signed but unencrypted and are searchable and archivable in the mail client.
   • Personal and Registered messages remain encrypted until the recipient actively authenticates to open them.

Frequently Asked Questions

Does MGI work with IMAP? No. MGI operates exclusively at the SMTP/gateway level. IMAP is not supported for the MGI integration. If your environment only supports IMAP, consider using the IncaMail Web Interface or the domain suffix method instead.

Can I configure multiple domains? Yes. Each domain is configured separately in the MGI administration portal. Each domain requires its own MTA Check and its own CN entries for inbound and outbound.

What if the CN in my MTA Check result differs from what I expected? This is common when a mail gateway performs SSL termination on behalf of the mail server. The CN shown in the MTA Check result is the one that must be entered in the portal — use this value even if it differs from the mail server certificate.

Is a static IP address required? No. IncaMail determines the receiving host via MX DNS lookup by default. Using static IPs is not recommended as these can change. A static hostname is acceptable as an alternative to DNS-based routing.

Can incoming messages be routed directly to your mailinfrastructure instead of using an MX lookup? Yes. If you you want to receive messages directly on your mail server bypassing your mail gateway, please reach out to our support team providing the hostname(s)/IP(s) of your mail infrastructure.

Can I use IncaMail MGI without the Outlook Add-in? Yes. The Outlook Add-in is optional. You can send IncaMail messages using the domain suffix method from any email client, or via the IncaMail Web Interface.