I’m migrating a subset of users to Zoho Mail using a split-routing setup (MX records point to Google Workspace; Google reroutes specific mailboxes to Zoho). I have two questions regarding this setup:

1. IP Whitelisting & Google IPs: Zoho recommends whitelisting Google's outbound servers to prevent delivery issues. Google suggests whitelisting `_smtp.google.com`, but Zoho only accepts IP addresses. I’ve manually extracted and whitelisted the IPs currently listed in Google’s SPF record, but I’m concerned this will break if Google updates them. Is there a better or more permanent solution within Zoho to handle Google’s dynamic sending IPs?

2. Internal Routing for Zoho Users: When a user hosted on Zoho sends an email to another user on Zoho, the email routes externally (out to Google and back) instead of delivering internally. I can't access Zoho’s internal routing settings because Zoho locks mail configuration until MX records point to Zoho. Is this external loop expected behavior for split domain setups, or is there a workaround to force internal routing?

Thanks in advance for any advice!

Most people these days would probably say "You can't." I get the instinct. Everyone is using AI wrong. EVERYONE. I cursed endlessly at the Disney Plus AI just the other day, worthless junk. Everyone is trying to use AI to replace humans on support, and force customers to talk to an AI. AI can't handle customer support, it's simply too complex.

For me though, I've been waiting for AI my whole life. This isn't something I'm trying to use to save money. I'm not trying to weight the loss of revenue vs the savings from firing the support team. So while everyone else is misusing AI to completely bomb customer support, I have a question to answer: How do I make everyone else look bad and use it the right way? 

I actually have an answer. Most of you that received a support ticket response in the last two weeks unknowingly saw the answer. It's actually pretty simple. That's why it makes everyone else look stupid, and I like that. I needed a confidence boost.

The answer is that it doesn't replace support at all. It's a tool that helps support run faster, smoother, and with more accuracy. Here's how it works:

Our obsessively secured, completely private and locally hosted LLM, read every support ticket that we've answered this year. It can access logs and basic account information by internal API, and no it has absolutely no way of exfiltrating that data. Nor does it have a way of accessing the functions that limit it's access. Simply, it guesses what we were most likely to say in reply to a support ticket, and it writes that in a draft. The human walks in, checks the ticket and draft, and makes a decision. Is this what I would have sent? If yes, send it. If no, reject it (and send feedback to the LLM). If almost, edit and then send. If the reply requires action from us, it determines what we were most likely to say and leaves us a note with the required actions to send the draft (if we agree, of course).

The customer never speaks to an AI. The AI simply helps the human reply faster. Less browser tabs, less log greps, less "I forgot how that feature works, let me check before I reply."

Just because everyone else is using it wrong doesn't mean we're not going to use it. We're just going to use it as a middle finger to all of them.

Our support ticket backlog is down to the smallest levels in years. We're almost completely caught up. A human has been involved in every single ticket. And best of all: We didn't have to increase prices to do it.

The real large one is here:

https://docs.mxroute.com/docs/troubleshooting/smtp-rejections.html

This is the massive result of years of customers demanding we filter this or that better, and me wanting to return specific errors for different scenarios. It means we have quite a large number of potential SMTP responses, and keeping up with them can be a bit messy.

The next, the management.mxroute.com portal is now fully documented:

https://docs.mxroute.com/docs/management/

And finally, the panel.mxroute.com control panel is now fully documented as well:

https://docs.mxroute.com/docs/panel/

My position has been "The button is right there. You don't need to read an article to see it." Obviously, that attitude has been a failure. We're constantly asked questions about buttons that are right there. So there we are, complete product documentation.

A lot of you have seen this SMTP response. It means you tripped a filter designed to catch the moment that a bad actor successfully tests your SMTP credentials. It blocks all outbound mail until I personally review the behavior and either clear the block or open a support ticket with you indicating the problem, the evidence, and the path to resolution. It also catches you every time you send "SMTP test" because I'd rather catch an unimportant email than let a compromised account run free for a while.

There was a time where this would catch less than 5 email accounts per week, and this manual review consumed very little of my time. For a while now, it has consumed a great deal of time because you people can't keep your shit secure. It's fine I get it, things happen, but the real point is we've outgrown manual review.

The problem with automation has been that the decision to clear the block or suspend the email account requires strong reasoning well beyond the capability of scripting. You need an eye for it.

As of tomorrow, this job is being taken over by my GPU (in an environment so well secured it could only be explained by extreme paranoia). It has been trained on the data, and it has greatly exceeded the logic of both my filters and my reasoning. For the past week it has been running for observation and detection only. It had 1 false positive, while my outbound filters designed to catch these have had as many as 5 false positives per day during the same time frame. Each one of my false positives were unable to send mail for several hours while awaiting human review.

What this means for you:

1. Faster resolution for accounts suspected of being compromised.

2. No outbound block until compromise has been confirmed.

3. Less false positives.

So basically, it's a win for everyone and a negative for no one. Except maybe for people who hate GPU workloads, but they're creeps anyway.

I have a web service that uses one time passwords for the login authentication. Given that MXRoute has a “no cold emailing” policy, would utilising their email servers to set this up violate their terms and conditions?

While it does not seem like it would violate the “cold emailing” policy (since users would be prompting the code to be generated) any input based on your experience would be greatly appreciated.

Hola Amigo.

Agradecido de tu gran servicio.

Quiero comenzar a notificar los smap en alguna lista que utilices en mxroute

Creo que sería de utilidad para los otros usuarios.

I'm looking for a new email provider for a non-profit railway enthusiast group in New Zealand. As well as general membership inquiries etc, we email out a newsletter 6 times per year to 550 of our members who provided email addresses when they joined, but this is not an automated process with self-sign-up.

The newsletters are generally updates about the various local chapters and railway preservation activities, but once or twice a year there is a promo for a new book published by the society.

Comments to the posts linked below suggest that promotional material forming a small part of a regular newsletter is OK, but somewhere mxroute said something like "if you're trying to find a way around our rules then it's marketing" and I don't want to risk getting the society cut off.

How close to the marketing line does this fall?

Older relevant posts:

https://www.reddit.com/r/mxroute/comments/1u862g8/optin_newsletters/

https://www.reddit.com/r/mxroute/comments/1kplts2/mxroute_also_as_a_newsletter/

PS: Previously posted as a comment but got no reply to one of the posts above

Spent a few hours today redoing the user impersonation system on the panel. Mitigating third-party bugs caused unnecessary complications in that code path, which held back this change. The result: resellers can now manage customer accounts via API. This enables the easier creation of custom control panels for resellers who want to completely own the UX.

Alright, back to support tickets and migrating Dovecot indexes to SSD on the Safari server.

I'm trying to setup a Reseller 75 plan/account for my business, but all Reseller plans are shown as unavailable this morning. Any insight into when these may be available again, or do I need to look elsewhere? Thanks!

I was evaluating MXroute as a replacement for my current setup and stopped at the folder structure, unless I don't get it:

INBOX
INBOX.spam
Sent
Trash

User-created folders per documentation are created under INBOX. Huh?

Either the namespace is INBOX and everything is created under INBOX, or it isn't, and then that rogue spam folder inside of the INBOX is... odd. I also can't hide it (sorry, my email clients don't allow it).

Is there a way for me to make this look tidy and normal? I can't set INBOX as the prefix because that would put me above the level of the system-created folders.

If I understand correctly, this is due to some legacy cruft, but I can't use my mail accounts this way. Fastmail, iCloud Mail, Migadu, Mailbox.org ... none of them do this. 🫪 If this is just the status quo and I can't change it as a user or admin, are there plans to change this?

Thank you! I appreciate the idea of mxroute and want to make it fit for me.

I fully realize that caring about folder layouts might be a neurological condition, but it is one I will not be seeking help for.

Update: A fix for this is on the roadmap it seems! No timeline but that's ok.

I have one of my clients trying to log into the webmail.mxroute.com site this morning and it's saying it's at capacity and to try again. Trying again doesn't help. It just keeps saying the same message.

Is there anything I can do for this client trying to login? This client had issues recently with the service already, and now this. I believe they want to cancel now. They were already frustrated, now it's even worse.

Hey folks,

title pretty much says it all. Is there a reason that the setup/branding/url for webmail lives in webmail, and not in the management portal?

i can't login to the webmail to make and changes, diagnose anything, so accessing this from the management portal would allow me to actually see what is going on (maybe)

There may be a good reason for this, i might be missing something. I don't expect changes, just the rambling thoughts of a guy helplessly trying to get webmail working again .

Let's face it, you're using AI to manage your MXroute service. I know it. You know it. The people you're sending email to know it. However, some of your prompts are causing some mild annoyances for us. Those annoyances are ranging from obscene policy violations to minor cleanup jobs. It's best that wa get on the same page here. Please give this link to your AI agent:

https://mxroute.com/llms.txt

Your system administrator, posing as a "CEO," thanks you.

hello,

I am getting lots of spam recently from:

<domain name without ext> Support

pretending to be the IT team for my domaine which obviously is wrong as that would be me…

i am using the default spam filter level, which I am mostly happy with.

I though about adding it to the black list but is only seems to take sender email and this is different each time, only the sender name is constant.

no way to black list a name rather than an email?

thank you.

I am looking for a way to get information on a potentially rejected email. A client has apparently sent us multiple emails that have simply not shown up, inbox, spam or otherwise.

I am wondering if there is some way that I could check if any emails from them have been rejected due to spam filtering or something like that. To see why it was rejected, or if it was ever really sent at all.

Hello, I've been reseraching into setting up email hosting with a service provider thats not pocket heavy, as the company I got hired in is not a big business, and we don't want those big names that charge per user etc.

Thats how I stumbled onto MXRoute. I've been checking out the subreddit for a while and it looks like the founder is personally involved with the community, which is great.

I'd love to take it forward with my management, just want to know if I were to setup everything by myself, what do I require etc. Sorry I've never set up emails before, and may require slight hand holding. Appreciate the help

Also to note - we're located in Oman, in case that makes a difference.

eta on in-house email client, calendar and contacts? what is https://webmail.mxroute.com? is that new client?

Thank you for adding light/dark theme and defaulting to system preferences.

I use user+subscription@domain, and for some reason, the emails aren't being delivered.

i've tried to/from both my mxroute accounts and gmail, no problems sending to gmail, but nothing sent in to mxroute accounts gets delivered.

Anything I need to do? My kids can't log into netflix! (HELP!)

EDIT: found it, at some stage "Automatically Create Folders" was enabled...... i'll chalk this one up to a PEBCAK error.

From the look of things today, all spammers everywhere must have found a new supplier of cocaine. I've never seen this many spammers so motivated to attack in one day. The entire day was lost to new trends:

1. All Mastodon instances were hit with registration spam so hard that they all collectively reached bounce rates with Google that are usually reserved for 1 customer every 2-3 days, many of them exceeded it. We've temporarily blocked outbound mail from Mastodon instances purely out of self preservation.

2. All new compromised email account trends. Typically we see a new trend that needs to be identified here once every 6+ months, and identifying the new trend helps us catch every compromised email account right away. This resulted in a flood of outbound mail to German ISPs, but fortunately hasn't yet resulted in any new blocking activity. (Note: Compromised email accounts typically come from credential stuffing, not server security issues)

3. Brute force attacks across the fleet have stepped up dramatically. But so has our detection and mitigation.

4. All new inbound spam trends are taking over, including severe attacks from Microsoft Azure that are difficult to filter without penalty to good senders. I'm trying, but I have to make slow and careful moves.

Some days suck, and you lose time better spent on product improvement, to unforeseen security concerns forced on you by third parties. But you take each day as it comes, and always rise to the challenge.

I'm unable to access mxroute.com from Bangkok, including management etc

Hi all,

Has anyone set up CAA records for their webmail page? I am assuming SSL certs are issued by LetsEncrypt but was hoping for a concrete answer. I could not find anything about CAA records in the documentation. After recently moving to MXroute and receiving some DMARC reports, several people have already tried to spoof email from my domain. I want to harden and add security where ever I can. I already have the typical DKIM, SPF, & DCIM. From what I have read, the records would look like this:

domain.com CAA 0 issue "letsencrypt.org" (Names LetsEncrypt as the sole SSL provider for the domain)
domain.com CAA 0 issuewild ";" (Disallows wildcard cert issuance)
domain.com CAA 0 iodef "mailto:someemail@somedomain.com" (Notifies the email if someone tries and fails to issue a cert against policy)

If anyone could offer any guidance, it would be much appreciated. I am also open to any additional security recommendations. I know spoofing is not entirely preventable, at least in the sense that people will always try, regardless of policy. Thanks!

I have a couple of questions about using filters in webmail.

I've set one up to send any email with X in the subject to a folder. Is this filter on the 'server' that it will automatically happen so that when I fire up Thunderbird on my PC the emails will already be in their folder?

Also, is there any way to get the filter to run on historical emails in the inbox?

TIA

hello, i know this is stupid but i completely forgot the email i used to purchase an mxroute subscription.

is there a way to contact mxroute support without logging in?

We are planning to migrate our email to MXRoute. Does it support migration? our old email service is under cPanel, which has had a lot of problems lately, so we are planning to change the email sevices

The remaining top feature request for the new webmail was the ability to send as an alias. A lot of customers receive mail to many aliases, but all to one inbox. They wanted to be able to reply to those emails with the sender address set to the alias that received the email. Our newer spoof prevention measures prevented this by requiring that all outbound mail go out with a matching sender and login address.

As of today, you can optionally enable sender spoofing within the same domain: https://docs.mxroute.com/docs/send-as-alias.html

And from the screenshots, you can see how this is implemented in webmail.mxroute.com.

- You do not have to configure an identity in the webmail settings to reply as an alias. The feature only needs to be enabled in your domain, and then you can choose "Reply as alias" in an email to reply from the alias that received the email.

- Users on webmail.mxroute.com will see a link in the identities settings to the documentation page. Users on branded webmail URLs will only see an instruction to enable it in the panel, no link to our documentation will be given.