Skip to content
mxproxy
Sign in Create a free account

Transparency

Abuse policy

mxproxy only works if mail servers trust it. So we do not tolerate spam or fraud, and anyone can report a domain that uses the service, no account needed.

What is forbidden

As in the Terms of Service, you may not use mxproxy for:

  • spam: unsolicited bulk email, bought or harvested lists, messages without an unsubscribe where the law requires one;
  • phishing and fraud: forging senders or impersonating any person or company;
  • malware: spreading viruses, malicious links or dangerous attachments;
  • getting around blocks through forwarding: delivering to someone messages from a sender that person or their provider has blocked, or “laundering” through your domain messages that would be refused at the source;
  • hiding the origin of an abusive message, getting around the plan limits, the SMTP authentication or the anti-abuse controls, or attacking the infrastructure;
  • illegal content, harassment or infringing the rights of others.

What the service already prevents

  • We only receive email for domains whose ownership was proven with a DNS TXT record.
  • We are not an open relay: port 25 only accepts recipients on those domains, and port 587 requires a login and only sends as the credential’s domain.
  • We check SPF, DKIM and DMARC on incoming mail and filter spam with rspamd.
  • Each plan has daily message limits, which contain the damage of a compromised account.

How to report

Write to abuse@mxproxy.dev, no account needed, with:

  1. the message you received with its full headers (in Gmail, ⋮ › Show original; in Outlook, View message source);
  2. the address or domain involved and the approximate date;
  3. what happened (spam, phishing, malware...).

If the message went through us, the Received header shows our server and the ARC-Seal carries our signature.

What we do with each report

  • We check our log for whether the message really went through mxproxy and which team it belongs to.
  • Once abuse is confirmed, we limit or suspend the domain, the SMTP credential or the account, without prior notice when it is urgent (risk to third parties or to our IPs’ reputation). Whenever possible, we tell the team owner and explain why.
  • On an order from a competent authority, we cooperate within the limits of the law, with whatever data we still have: the message log keeps 30 days (see What we log).

Disagree with a suspension? Write to contato@mxproxy.dev explaining the case.

Was your domain forged?

Any server can put your domain in the sender; our SMTP only sends with a credential of the domain itself, so a forgery does not leave from here. The defense is publishing DMARC with p=quarantine or p=reject: providers then refuse what does not come from the authorized servers. The domain checker shows whether your DMARC is published.

Frequently asked questions

How do I report abuse from a domain that uses mxproxy?

Write to abuse@mxproxy.dev with the message you received and its full headers (in Gmail, Show original). You do not need an account.

What happens to the reported domain?

We check our log for whether the message went through us. Once abuse is confirmed, we may limit or suspend the domain, the SMTP credential or the account, without prior notice when it is urgent, and we tell the team owner whenever possible.

Someone is sending fake email in my domain’s name. Is it mxproxy?

Probably not: our SMTP only sends with a credential of the domain itself. Forging a sender does not depend on us; publish DMARC with p=quarantine or p=reject so providers refuse the fake messages.

Do you hand data to authorities?

Only on an order from a competent authority, within the limits of the law and with whatever data we still have: the message log, for instance, keeps 30 days.

Want to try it with your domain? The free plan needs no card. Create a free account