May 13, 2025

New Email Security Features - Two-Factor Authentication (2FA) for Webmail and Non-Webmail Access Control

We are excited to introduce two powerful enhancements to our email service, designed to keep your mailboxes even safer.

To accommodate the new security features, we replaced the Password button next to each mailbox in the hosting Control Panel > Mail Manager with a new one called Security. Clicking this button will take you to a page that contains the password change option, as well as the two new security enhancements:
 
Two-Factor Authentication (2FA)

Two-Factor Authentication enhances the security of your Webmail account by requiring two forms of identification during login: your password and a time-based security token. The security token can be generated using a variety of applications compatible with phones, tablets, computers, and smartwatches, such as Google Authenticator and Apple Passwords. By implementing 2FA, the risk of unauthorized access to your email account is significantly reduced.

You need to log in to Webmail to enable 2FA for any mailbox where you want to use this security feature. Here is how you can enable the option depending on the Webmail client you prefer:

  • Webmail Classic - go to Options > Password & Security and click Enable in the Two-factor authentication section.
  • Roundcube Webmail - go to Settings > Two-factor Authentication and click Enable.

Instructions on how to use 2FA for Webmail are available in the Using Two-factor Authentication (2FA) article in our documentation.

Non-Webmail Access

The Non-Webmail Access option allows you to restrict mailbox access by external mail clients (e.g. Apple Mail, Microsoft Outlook, Mozilla Thunderbird) and scripts using IMAP, POP3, and SMTP protocols. When non-webmail access is disabled, connections through IMAP/POP3/SMTP are blocked, ensuring that only Webmail is used to access the mailbox. Combined with 2FA, this feature provides an additional safeguard against unauthorized access and enhances overall mailbox security.

You can enable this option from both the Control Panel and the Webmail client you prefer as follows:

  • Control Panel - go to Mail Manager > Security next to the desired mailbox > click Enable in the Non-Webmail access section.
  • Webmail Classic - go to Options > Password & Security and click Enable in the Non-Webmail Access section.
  • Roundcube Webmail - go to Settings > Non-Webmail Access and click Enable.

Check out the Non-Webmail Access Control article in our documentation for more information about this security feature.

If you only use Webmail to access your email, we recommend taking advantage of both Two-Factor Authentication (2FA) and Non-Webmail Access to maximize the security of your mailboxes. For optimal security, make sure you also use 2FA for the hosting Control Panel, as well as 2FA for the ICDSoft Account Panel.

Security matters, and we hope these new features give you greater control and protection over your email.