日本語版

SecureMail User Manual

A practical step-by-step guide for form owners. If you just want to know what SecureMail is, see the landing page; if you have a quick question, see the FAQ.

What is SecureMail?

SecureMail is a free service that gives you a private contact-form URL you can embed on any website. Visitors send you messages via that URL without ever seeing your email address. You receive a notification email and can read the message in a private read-page or via My Page.

It is operated by Kodama & Co. and has been running since 2005.

1. Register your email

Registration takes about 60 seconds and requires no password.

1. Open the landing page. In the "Get started" section at the bottom (or the hero form at the top), enter your email address.
2. Click Send confirmation email. We immediately email you a confirmation link valid for 1 hour.
3. Open the confirmation email and click the link. The link takes you to a page that shows your dedicated form URL:

   https://ssl.kodama.com/securemail?id=<22-character ID>

4. Copy this URL. This is the URL you will embed on your website.

2. Place the form URL on your site

The form URL is just a normal HTTPS link. Wrap it in an <a> tag anywhere on your page.

<a href="https://ssl.kodama.com/securemail?id=abc123...">
  Contact me securely
</a>

Common placements: site footer, "Contact" page, sidebar widget, blog post end-line, business card or email signature.

Embed it as a button (optional)

<a href="https://ssl.kodama.com/securemail?id=abc123..."
   style="display:inline-block; padding:.6rem 1.2rem;
          background:#1a6ee0; color:#fff; border-radius:4px;
          text-decoration:none;">
  Contact me
</a>

Lost your URL?

Sign in to My Page with the same email you registered with. Your form URL is shown on the dashboard with a one-click copy button.

3. Receive and read messages

When a visitor sends a message you have two ways to read it.

A. Notification email

SecureMail sends a notification email to your registered address. The email contains a private read-link such as:

https://ssl.kodama.com/readmsg?id=...&msg=...

Click the link to open the message in your browser. The first click marks it as read.

B. My Page

Sign in to My Page to see all received messages in chronological order with unread badges. Click a row to read the full message. This is the recommended way to review history or read messages on devices where the notification email is hard to access.

About the "Source page" field

Each received message may show a Source page — the URL of the page on your site (or anywhere else on the web) that the visitor was looking at when they opened your form. It is useful for traffic analysis ("which of my pages drives the most inquiries?") and for spotting where spam is coming from.

Next to the URL you will see (unverified). This means the value is reported by the visitor's browser and we do not independently confirm it. A casual user cannot fake it, but a technically skilled sender — or a bot — can put any URL there, including a URL that has nothing to do with where they really came from.

Treat the Source page as a hint, not as evidence. Do not click it unless you recognize the domain and trust it. It is shown as plain text (not as a clickable link) on purpose, to avoid accidentally sending you to a malicious site.

4. Use My Page

My Page is a self-serve dashboard at /mypage/. No password.

Signing in (magic link)

1. Open /mypage/login and enter your registered email.
2. We email you a sign-in link valid for 15 minutes.
3. Click the link. You are signed in and see your dashboard.

Sessions last only for the current browser session. Closing the browser signs you out. Sign back in any time with one email.

What you can do

5. Spam protection (in detail)

SecureMail blocks spam in two layers. The automatic layer blocks bots before they can submit anything (no setup needed). The manual layer lets you block specific senders, domains, or keywords yourself — for the persistent sales emails and solicitations that bots can't catch.

5.1 What gets blocked automatically

Honeypot field + IP rate-limit run on every submission. They catch automated bot submissions without you doing anything.

Anything caught at this layer is silently discarded — it never appears anywhere, not even in the Spam folder. There is no false-positive risk because both checks rely on machine-only behaviours.

5.2 The Spam Settings page

Open Spam Settings. You see two text boxes.

5.3 Sender block list (top text box)

Enter one entry per line. Each line is interpreted as either an email address or a domain.

5.4 Keyword block list (bottom text box)

Enter one keyword per line. Any message whose subject or body contains that keyword is blocked. Matching is case-insensitive and handles full-width / half-width characters automatically (so UNSUBSCRIBE, unsubscribe, and ＵＮＳＵＢＳＣＲＩＢＥ all match).

Common useful keywords for stopping sales spam:

• unsubscribe — almost no genuine inquiry contains this word; it's standard in marketing email footers.
• opt-out
• special offer
• SEO (if you don't sell SEO services and you keep getting SEO pitches)
• backlink

5.5 What happens when a message is blocked

1. The message is not deleted; it is moved to your Spam folder.
2. You receive no notification email. (The folder is the only place to find it.)
3. The sender sees a normal "message sent" screen. They can't tell they've been blocked.
4. The message is automatically deleted 30 days later.

5.6 The Spam folder

Open /mypage/spam-folder. You see a list of blocked messages with the reason each was blocked (which address, domain, or keyword matched).

You can:

• Delete individual messages, all selected, or everything in the folder. Deletion is immediate and permanent.
• Click a row to read the full message in a private preview.
• "Not spam" — restore the message to your normal inbox. The dialog also offers to remove the offending block list entry that caused the false positive (one click).
• Wait — items older than 30 days disappear on their own.

5.7 Recovering a false positive

1. Open the message in the Spam folder.
2. Click Not spam (restore to inbox).
3. If the block was caused by an entry still in your block list, the dialog asks whether to remove that entry too. Check the box if you want the same sender to come through next time as well.
4. The message reappears in your normal Messages list as unread.

5.8 Recommended starter setup

If you're brand new, here's a conservative starting point that catches the obvious and risks no false positives:

• Sender block list: empty for now. Add specific spammers as they appear.
• Keyword block list: unsubscribe. Watch the Spam folder for a few days. If you start seeing more pushy templates, add their distinctive phrases one at a time.

6. Change email or cancel

Changing your registered email

1. Sign in to My Page → Account.
2. Enter the new email address. We send a confirmation link to the new address.
3. Click the link to apply the change.
4. The old address receives a notification email so you'd notice if someone else triggered the change.

Cancelling your account

1. Sign in to My Page → Cancel.
2. Confirm. Your account is immediately closed.
3. For 30 days the data is held in a grace period. If you change your mind, register again with the same email and everything (account, message history, block list) comes back.
4. After 30 days the data is permanently deleted and cannot be restored.

7. Troubleshooting

"My confirmation / sign-in / notification email never arrived"

• Check your spam folder. The sender domain is kodama.com.
• Wait 2–3 minutes. Some providers delay automated mail.
• Confirm the email you typed is your real registered address.
• If still missing, sign in to My Page directly to read messages even without the notification.

"My visitors say the form won't submit"

• Check that the URL and ID are unchanged.
• Confirm your account isn't cancelled (sign in to My Page).
• Browser ad-blockers can sometimes block JavaScript on contact forms; the form falls back to a plain POST so it should still work.

"A real inquiry was filed as Spam"

Open the Spam folder, click the message, click "Not spam (restore to inbox)". The dialog offers to remove the block list entry that caused it.

"I want to start over"

Cancel the account from /mypage/cancel. Within 30 days you can re-register with the same email; after 30 days you can re-register fresh with no history.

I can't find what I need here

See the FAQ or contact us through our own form: SecureMail contact form.

Back to top   Sign in to My Page