Can a team member read mail sent to addresses they were not given?

Not unless their role reaches every address. Otherwise their list only holds mail for the addresses they were given, and asking for any other thread is answered Thread not found.

Can an admin read every address in the workspace?

Not with the built-in Admin role. Reading an address takes a grant for it or for its whole domain, unless you give them a role set to reach every address.

What happens to shared access when an address is switched off?

Mail to it bounces, but everyone it was shared with keeps reading what arrived before. A password sign-in for the address stops working until it is switched back on. Removing the address is what takes their access away.

Workspaces & team

Scoped visibility
One address means one address.

Give somebody billing@ and billing@ is all they read. The server checks what they hold on every read, and again as each thread opens.

Open mailGet StartedAll features

In short

What is scoped access to a shared mailbox?

When several people share one mailbox, scoping decides which addresses each of them can read. It only counts if the server enforces it: an address hidden in the interface is still one crafted request away.

How it works

The server decides, on every read

Access comes from the signed-in session, never from the request. Ask for an address you do not hold and the request is refused.

Every thread is checked again

Open a thread outside your addresses and the server answers Thread not found. Every action on a thread, down to an attachment download, repeats the check.

Switch it off, mail stops

Mail to the address bounces the moment its Receiving switch goes off. Everyone it was shared with keeps what arrived before, and new mail reaches them again when the switch goes on. A password sign-in for the address stops working until then.

What you get

In the product today

Whole domains too

A domain grant covers every address on it, including ones made later.

Counts stay inside

Folder and unread counts only cover the addresses somebody holds.

Roles widen it only on purpose

A role says what somebody may do. It adds addresses only when it is set to reach every address.

Owner reads everything

It comes with the workspace, not a grant. Everyone else reads what they hold.

Good practice

Getting the most out of it

01
Check who reaches it
Before sharing, open the address page: Who can reach it lists everyone, whole-domain grants included.
02
Prefer single addresses
Grant a whole domain only when they should also get every address added to it later.
03
Switch off to pause mail
Switching an address off stops its mail and keeps who can read it, but a password sign-in for it stops working while it is off. Removing the address takes their access away.

Questions

Asked often

Keep going

Works well with

Share an address

Hand billing@ to the person who does the billing.

Roles & permissions levels

A role says what somebody may do, and an address grant says where, unless the role reaches every address.

Invitations

Share with someone who has not signed up yet and have them invited.

Start

Your domain,
your mail.

Point a domain at Nextmail and read it in a mailbox built around it. The free plan covers one domain.

Open mailGet StartedRead the reference

Scoped visibilityOne address means one address.