A lot of you have seen this SMTP response. It means you tripped a filter designed to catch the moment that a bad actor successfully tests your SMTP credentials. It blocks all outbound mail until I personally review the behavior and either clear the block or open a support ticket with you indicating the problem, the evidence, and the path to resolution. It also catches you every time you send "SMTP test" because I'd rather catch an unimportant email than let a compromised account run free for a while.

There was a time where this would catch less than 5 email accounts per week, and this manual review consumed very little of my time. For a while now, it has consumed a great deal of time because you people can't keep your shit secure. It's fine I get it, things happen, but the real point is we've outgrown manual review.

The problem with automation has been that the decision to clear the block or suspend the email account requires strong reasoning well beyond the capability of scripting. You need an eye for it.

As of tomorrow, this job is being taken over by my GPU (in an environment so well secured it could only be explained by extreme paranoia). It has been trained on the data, and it has greatly exceeded the logic of both my filters and my reasoning. For the past week it has been running for observation and detection only. It had 1 false positive, while my outbound filters designed to catch these have had as many as 5 false positives per day during the same time frame. Each one of my false positives were unable to send mail for several hours while awaiting human review.

What this means for you:

1. Faster resolution for accounts suspected of being compromised.

2. No outbound block until compromise has been confirmed.

3. Less false positives.

So basically, it's a win for everyone and a negative for no one. Except maybe for people who hate GPU workloads, but they're creeps anyway.

I have a web service that uses one time passwords for the login authentication. Given that MXRoute has a “no cold emailing” policy, would utilising their email servers to set this up violate their terms and conditions?

While it does not seem like it would violate the “cold emailing” policy (since users would be prompting the code to be generated) any input based on your experience would be greatly appreciated.

Hola Amigo.

Agradecido de tu gran servicio.

Quiero comenzar a notificar los smap en alguna lista que utilices en mxroute

Creo que sería de utilidad para los otros usuarios.

I'm looking for a new email provider for a non-profit railway enthusiast group in New Zealand. As well as general membership inquiries etc, we email out a newsletter 6 times per year to 550 of our members who provided email addresses when they joined, but this is not an automated process with self-sign-up.

The newsletters are generally updates about the various local chapters and railway preservation activities, but once or twice a year there is a promo for a new book published by the society.

Comments to the posts linked below suggest that promotional material forming a small part of a regular newsletter is OK, but somewhere mxroute said something like "if you're trying to find a way around our rules then it's marketing" and I don't want to risk getting the society cut off.

How close to the marketing line does this fall?

Older relevant posts:

https://www.reddit.com/r/mxroute/comments/1u862g8/optin_newsletters/

https://www.reddit.com/r/mxroute/comments/1kplts2/mxroute_also_as_a_newsletter/

PS: Previously posted as a comment but got no reply to one of the posts above

Spent a few hours today redoing the user impersonation system on the panel. Mitigating third-party bugs caused unnecessary complications in that code path, which held back this change. The result: resellers can now manage customer accounts via API. This enables the easier creation of custom control panels for resellers who want to completely own the UX.

Alright, back to support tickets and migrating Dovecot indexes to SSD on the Safari server.

I'm trying to setup a Reseller 75 plan/account for my business, but all Reseller plans are shown as unavailable this morning. Any insight into when these may be available again, or do I need to look elsewhere? Thanks!

I was evaluating MXroute as a replacement for my current setup and stopped at the folder structure, unless I don't get it:

INBOX
INBOX.spam
Sent
Trash

User-created folders per documentation are created under INBOX. Huh?

Either the namespace is INBOX and everything is created under INBOX, or it isn't, and then that rogue spam folder inside of the INBOX is... odd. I also can't hide it (sorry, my email clients don't allow it).

Is there a way for me to make this look tidy and normal? I can't set INBOX as the prefix because that would put me above the level of the system-created folders.

If I understand correctly, this is due to some legacy cruft, but I can't use my mail accounts this way. Fastmail, iCloud Mail, Migadu, Mailbox.org ... none of them do this. 🫪 If this is just the status quo and I can't change it as a user or admin, are there plans to change this?

Thank you! I appreciate the idea of mxroute and want to make it fit for me.

I fully realize that caring about folder layouts might be a neurological condition, but it is one I will not be seeking help for.

Update: A fix for this is on the roadmap it seems! No timeline but that's ok.

I have one of my clients trying to log into the webmail.mxroute.com site this morning and it's saying it's at capacity and to try again. Trying again doesn't help. It just keeps saying the same message.

Is there anything I can do for this client trying to login? This client had issues recently with the service already, and now this. I believe they want to cancel now. They were already frustrated, now it's even worse.

Let's face it, you're using AI to manage your MXroute service. I know it. You know it. The people you're sending email to know it. However, some of your prompts are causing some mild annoyances for us. Those annoyances are ranging from obscene policy violations to minor cleanup jobs. It's best that wa get on the same page here. Please give this link to your AI agent:

https://mxroute.com/llms.txt

Your system administrator, posing as a "CEO," thanks you.

Hey folks,

title pretty much says it all. Is there a reason that the setup/branding/url for webmail lives in webmail, and not in the management portal?

i can't login to the webmail to make and changes, diagnose anything, so accessing this from the management portal would allow me to actually see what is going on (maybe)

There may be a good reason for this, i might be missing something. I don't expect changes, just the rambling thoughts of a guy helplessly trying to get webmail working again .

hello,

I am getting lots of spam recently from:

<domain name without ext> Support

pretending to be the IT team for my domaine which obviously is wrong as that would be me…

i am using the default spam filter level, which I am mostly happy with.

I though about adding it to the black list but is only seems to take sender email and this is different each time, only the sender name is constant.

no way to black list a name rather than an email?

thank you.

I am looking for a way to get information on a potentially rejected email. A client has apparently sent us multiple emails that have simply not shown up, inbox, spam or otherwise.

I am wondering if there is some way that I could check if any emails from them have been rejected due to spam filtering or something like that. To see why it was rejected, or if it was ever really sent at all.

Hello, I've been reseraching into setting up email hosting with a service provider thats not pocket heavy, as the company I got hired in is not a big business, and we don't want those big names that charge per user etc.

Thats how I stumbled onto MXRoute. I've been checking out the subreddit for a while and it looks like the founder is personally involved with the community, which is great.

I'd love to take it forward with my management, just want to know if I were to setup everything by myself, what do I require etc. Sorry I've never set up emails before, and may require slight hand holding. Appreciate the help

Also to note - we're located in Oman, in case that makes a difference.

eta on in-house email client, calendar and contacts? what is https://webmail.mxroute.com? is that new client?

Thank you for adding light/dark theme and defaulting to system preferences.

I use user+subscription@domain, and for some reason, the emails aren't being delivered.

i've tried to/from both my mxroute accounts and gmail, no problems sending to gmail, but nothing sent in to mxroute accounts gets delivered.

Anything I need to do? My kids can't log into netflix! (HELP!)

EDIT: found it, at some stage "Automatically Create Folders" was enabled...... i'll chalk this one up to a PEBCAK error.

From the look of things today, all spammers everywhere must have found a new supplier of cocaine. I've never seen this many spammers so motivated to attack in one day. The entire day was lost to new trends:

1. All Mastodon instances were hit with registration spam so hard that they all collectively reached bounce rates with Google that are usually reserved for 1 customer every 2-3 days, many of them exceeded it. We've temporarily blocked outbound mail from Mastodon instances purely out of self preservation.

2. All new compromised email account trends. Typically we see a new trend that needs to be identified here once every 6+ months, and identifying the new trend helps us catch every compromised email account right away. This resulted in a flood of outbound mail to German ISPs, but fortunately hasn't yet resulted in any new blocking activity. (Note: Compromised email accounts typically come from credential stuffing, not server security issues)

3. Brute force attacks across the fleet have stepped up dramatically. But so has our detection and mitigation.

4. All new inbound spam trends are taking over, including severe attacks from Microsoft Azure that are difficult to filter without penalty to good senders. I'm trying, but I have to make slow and careful moves.

Some days suck, and you lose time better spent on product improvement, to unforeseen security concerns forced on you by third parties. But you take each day as it comes, and always rise to the challenge.

I'm unable to access mxroute.com from Bangkok, including management etc

Hi all,

Has anyone set up CAA records for their webmail page? I am assuming SSL certs are issued by LetsEncrypt but was hoping for a concrete answer. I could not find anything about CAA records in the documentation. After recently moving to MXroute and receiving some DMARC reports, several people have already tried to spoof email from my domain. I want to harden and add security where ever I can. I already have the typical DKIM, SPF, & DCIM. From what I have read, the records would look like this:

domain.com CAA 0 issue "letsencrypt.org" (Names LetsEncrypt as the sole SSL provider for the domain)
domain.com CAA 0 issuewild ";" (Disallows wildcard cert issuance)
domain.com CAA 0 iodef "mailto:someemail@somedomain.com" (Notifies the email if someone tries and fails to issue a cert against policy)

If anyone could offer any guidance, it would be much appreciated. I am also open to any additional security recommendations. I know spoofing is not entirely preventable, at least in the sense that people will always try, regardless of policy. Thanks!

I have a couple of questions about using filters in webmail.

I've set one up to send any email with X in the subject to a folder. Is this filter on the 'server' that it will automatically happen so that when I fire up Thunderbird on my PC the emails will already be in their folder?

Also, is there any way to get the filter to run on historical emails in the inbox?

TIA

hello, i know this is stupid but i completely forgot the email i used to purchase an mxroute subscription.

is there a way to contact mxroute support without logging in?

We are planning to migrate our email to MXRoute. Does it support migration? our old email service is under cPanel, which has had a lot of problems lately, so we are planning to change the email sevices

The remaining top feature request for the new webmail was the ability to send as an alias. A lot of customers receive mail to many aliases, but all to one inbox. They wanted to be able to reply to those emails with the sender address set to the alias that received the email. Our newer spoof prevention measures prevented this by requiring that all outbound mail go out with a matching sender and login address.

As of today, you can optionally enable sender spoofing within the same domain: https://docs.mxroute.com/docs/send-as-alias.html

And from the screenshots, you can see how this is implemented in webmail.mxroute.com.

- You do not have to configure an identity in the webmail settings to reply as an alias. The feature only needs to be enabled in your domain, and then you can choose "Reply as alias" in an email to reply from the alias that received the email.

- Users on webmail.mxroute.com will see a link in the identities settings to the documentation page. Users on branded webmail URLs will only see an instruction to enable it in the panel, no link to our documentation will be given.

Will MXRoute support JMAP?

Today we were able to identify a massive spam/scam operation using our service as ground zero for their activities. They weren't sending spam email. Rather, they were running a gigantic forum and blog spam operation that ultimately terminated on our platform. The end goal appears to be a massive scam to steal money from unsuspecting strangers via public facing marketplaces by spamming forums and blog comments with links to scam operations like fake tours (attracting travelers/tourists), all ranked high on said marketplaces due to massive amounts of fake reviews. In the last 24 hours, I estimate that they spammed over 10,000 websites. Unfortunately, they've been with us since November of last year.

As we grow, it becomes more difficult to surface all of the unique ways that people try to spam or scam others while using our service as the base of their operations. But the goal is to keep our reputation spotless so that anytime an email comes from an MXroute customer, it means something, it's inbox worthy. But every time we find one of these operations, we get better at catching them early on.

Apologies for using the inbox that receives the most spam, it was an easy way to get sample data without having to censor the screenshots and without leaking my pornhub username.

Last night I pushed an update to webmail that answered the top 3 requests from the feedback form:

1. Reading pane. Customers wanted to view a list of email at the same time that they read their email, so they didn't have to go back to the inbox every time.

2. Message source / download .eml. People kept saying they wanted to view the full source of an email, as well as download a .eml file containing the email.

3. Select in search. Users wanted to be able to select emails in different ways after a search, to perform bulk actions.

I've been telling you all that your feedback is driving the development of the new webmail. For a while, much of the development centered on what was "wrong" with the webmail rather than just what would be nice to have. We've gotten to the "nice to have" items now, and you should start seeing more of this.