Korax is built and maintained by one person. Every report below lands in the same inbox and gets read by them. The fastest way to get an answer is email — the tracker is there too, but it asks you to make an account first.
Use whichever suits the problem. There is no wrong door.
Bugs, setup questions, feature requests, anything that needs a reply. A human answers these. Email is also the only channel that works when the problem is that your app cannot send mail.
mailto:korax@k-ops.euSettings → Send feedback. It goes out through your own account to the address above, with the version number and operating system filled into the subject line for you — so you don't have to go looking for them. Limited to four a day, so batch your notes rather than sending one line at a time.
Settings → Send feedbackOpen and public, best for bugs you are willing to write up properly yourself. You need a free account on our Gitea server to file one; if registering is a hassle, email instead and we will file it for you. Never use it for security reports.
git.k-ops.eu/…/korax-public/issuesThis is the whole difference between one email and four. None of it is hard.
If your question is here, the answer is here — no email needed.
Usually nothing: on the sign-in screen your email address is enough. Korax looks the settings up — from a built-in list for the big providers, otherwise from the DNS SRV records your mail server publishes, and only asks you if it comes up empty.
It knows these outright, so it skips the lookup:
| Provider | IMAP | SMTP |
|---|---|---|
| Gmail / Googlemail | imap.gmail.com:993 | smtp.gmail.com:587 |
| Yahoo / Ymail | imap.mail.yahoo.com:993 | smtp.mail.yahoo.com:587 |
| Outlook / Hotmail / Live | outlook.office365.com:993 | smtp.office365.com:587 |
| iCloud / me / mac | imap.mail.me.com:993 | smtp.mail.me.com:587 |
| GMX | imap.gmx.<domain>:993 | mail.gmx.<domain>:587 |
For anything else it falls back to
imap.yourdomain:993 and
yourdomain:587, which is the right
answer for most providers. Both are TLS from the
start; SMTP on 465 works too if your
provider prefers implicit TLS there. If
auto-detection picked wrong, the sign-in screen
offers Manual config where you can
correct it — that screen defaults to those same
ports.
Yes — connect it over IMAP/SMTP with a Google App Password. There is no “Sign in with Google” button, and there will not be one; the reason is that Google classifies the mail scope it needs as a restricted one, which comes with a paid annual security audit per app. For a small project that cost does not make sense, so the button is gone rather than the Gmail support.
App Passwords need 2-Step Verification switched on first. The full reasoning is in the discontinuation notice.
In the operating system's own credential store, never in plaintext in Korax's database or on disk. Your account password goes to the iOS Keychain and to the Android Keystore through the platform's secure storage; on Windows and Linux it goes to the equivalent for that desktop.
PGP private keys are handled by mailcore, Korax's open-source engine, which is in the repository for you to check rather than take our word for it.
Usually one of three things, in this order:
If you tell us the provider and the exact message, we can usually tell you which of the three it is.
On iPhone and iPad, mostly yes. Korax asks iOS to refresh the inbox roughly every fifteen minutes while it is in the background, and raises a notification for anything new. iOS decides the real schedule based on how you use the device and how much battery it thinks you have, so it will sometimes be hours rather than minutes — that is the system, not the app. Open Korax and it syncs immediately regardless.
On Android and on the desktop there is no equivalent background fetch: Korax checks for new mail while it is running. If you leave it closed, nothing arrives until you open it. We would rather tell you that than have you conclude something is broken.
Please do not open a public issue for a security problem. Mail korax@k-ops.eu instead and say plainly in the subject that it is a security report — it will get read ahead of everything else. There is a disclosure policy in the repository, and reasonable timelines are honoured.