Anfonwch hwn fel neges destun: Design and Proof of a Mail Service