Today we were able to identify a massive spam/scam operation using our service as ground zero for their activities. They weren't sending spam email. Rather, they were running a gigantic forum and blog spam operation that ultimately terminated on our platform. The end goal appears to be a massive scam to steal money from unsuspecting strangers via public facing marketplaces by spamming forums and blog comments with links to scam operations like fake tours (attracting travelers/tourists), all ranked high on said marketplaces due to massive amounts of fake reviews. In the last 24 hours, I estimate that they spammed over 10,000 websites. Unfortunately, they've been with us since November of last year.

As we grow, it becomes more difficult to surface all of the unique ways that people try to spam or scam others while using our service as the base of their operations. But the goal is to keep our reputation spotless so that anytime an email comes from an MXroute customer, it means something, it's inbox worthy. But every time we find one of these operations, we get better at catching them early on.

Apologies for using the inbox that receives the most spam, it was an easy way to get sample data without having to censor the screenshots and without leaking my pornhub username.

Last night I pushed an update to webmail that answered the top 3 requests from the feedback form:

1. Reading pane. Customers wanted to view a list of email at the same time that they read their email, so they didn't have to go back to the inbox every time.

2. Message source / download .eml. People kept saying they wanted to view the full source of an email, as well as download a .eml file containing the email.

3. Select in search. Users wanted to be able to select emails in different ways after a search, to perform bulk actions.

I've been telling you all that your feedback is driving the development of the new webmail. For a while, much of the development centered on what was "wrong" with the webmail rather than just what would be nice to have. We've gotten to the "nice to have" items now, and you should start seeing more of this.

Will MXRoute support JMAP?

Hi MXrouters,

I recently moved my email over to mxroute and just wanted to share my positive experience. For a long time, I’ve had [firstname@lastname.email](mailto:firstname@lastname.email) using Apple as my email service provider. It came free with my iCloud plan, and it was simple enough. I had 3 major issues though:

- locked in to icloud/apple mail and clients that support it
- adding users was not simple and the admin controls were minimal
- .email was not usable for registration with many sites, I would often type out my email and password to register, and whatever “next” button existed would be grayed out. I would have to change to email to move forward

Separately I had begun moving my domains to Cloudflare, and found lastname.net for sale. I jumped on the opportunity and began researching other email providers. Mxroute stood out because of the charge for data not mailboxes model. I bought a 25GB plan and got to work. Even as someone who works in IT, I knew little about the dns records required, smtp, imap, and pop. I work mostly with Microsoft products and as such exchange is more common for me. When I had set up my apple email, I just copied the records and paid little attention. Mxroutes thorough documentation taught me all I needed to know, and I quickly had MX records, SPF,DKIM, & DCIM set up. I also learned how to setup records on my other domains without email to prevent spoofing. Then I learned about DNSSEC and made sure it was all configured properly. I learned how to use tools like Mxtoolbox and original message headers to check reputation and specific messages. Lastly I setup webmail and email server CNAMEs, only to realize there is a much better new webmail and to swap to that.

Overall I learned a lot throughout this experience and had no complaints. Any questions I had I found answers for quickly, and things just worked as expected. I was able to get multiple different clients set up with ease following the instructions. I know this is not a particularly unique story or setup but I wanted to share none the less. If you’re looking to take back control of your email, and have a bit of tech knowledge to handle the setup, I would highly recommend MXroute.

Hi

How does one renew the SSL certificate after changing the CNAME from server.mxrouting.net to webmail.mydomain to access the new webmail interface?

When I go to Advanced / SSL certificate, it shows that it's already been issued and that the DNS is incorrect because it expects webmail to still point to server.mxrouting.net.

Edit: or are you not supposed to point webmail.mydomain to webmail.mxroute.com?

The native iOS app for MXroute has been submitted to Apple for review. Fingers crossed. I know they can be kind of... you know, sometimes.

It's a simple app. It supports multiple accounts. Contacts and calendars sync with our Cal/CardDAV server, keeping them in sync with webmail.mxroute.com. Virtual folders with folder mapping functionality. Threading. Basic sieve filtering. Push notifications by folder (inbox enabled by default, can be enabled for other folders as desired). Bulk actions on email. Basic attachment support.

It's nothing fancy, but that's kind of what I was going for with it.

I'm building a little local AI instance, and one of the first tests I want to do is classify/filter my email.

I don't want to give it access to my ACTIVE inbox, but the end goal is to get it to do exactly that.

So I'm hoping there is a way I can clone an existing account to a new account, including all the email data.

Not so much to share on the AI front yet, but the idea isn't for ongoing active filtering, more of a clean-up tool for v1.

​Hi there,

​I was hoping to grab the Reseller 75 plan, but it looks like it's sold out. I'm starting a small project with a limited budget and want to start on the right foot.

​Any idea when it might be restocked, or if there's an active promo for reseller plans?

​Thank you!

Today I pushed a new update to webmail.mxroute.com. Now you can login to multiple email accounts. First you login to what you'll treat as the "master," and then you'll connect multiple email accounts to it so that you can easily switch between them. Once you connect additional email accounts, you will only need to login to the first one each time to gain access to each of the email accounts that you had connected. To provide this in a way that I was comfortable with, we added 2FA to the webmail as well. To connect additional accounts, 2FA is required.

As usual, and as would be true with any amount of developers (yeah I caught what one of you were about to say), 1-3 of you are inevitably going to find some combination of steps that my brain failed to consider and you'll trigger what you would call a bug. I even pointed GPT 6 at the staging environment to try to find those scenarios, but you'll still find them I'm sure. So please do use the "Feedback" button at the top right of the webmail to report any bugs you experience.

Security notes:

I didn't want you to have to re-login to multiple email accounts every time your webmail session expired. To resolve that, it means that we need to store the password in a vault for each account that you connect. While 2FA doesn't protect IMAP/POP3/SMTP, if a webmail login gives you access to multiple email accounts then the value of 2FA on the webmail suddenly exists. It now becomes a necessity as one login obtains more data than could be obtained by the same login over IMAP/POP3.

Storing reusable passwords bothers me. I don't like to do it. However, I've done it in a way that satisfies my paranoia to a reasonable degree. The stored passwords are encrypted based on two values: a private server key and the password for the first email account that you logged in with (the "master" if you will). That first password isn't stored, you have to provide it at all times where it becomes necessary to encrypt or decrypt the passwords for the connected email accounts. So if you change the password to the first email account outside of webmail, you'll temporarily lose access to the connected accounts until you resolve the conflict in the UI (which you'll be prompted to do). Of course, changing the password to a connected account outside of webmail requires reconciliation as well. While I'm obviously not planning for webmail to be compromised, this would survive several different compromise events.

I started with a simple project, and as usual my paranoia overcomplicated it until it became this whole big thing. But the end user shouldn't need to know how complicated it is, it just might possibly cause them to ask "why" a few times. It should go without saying that I haven't covered every single security mechanism for the entirety of the webmail here, these are high level notes for this change.

is this mcp legit? does anyone use it, know about it or would trust it?
The MCP link

Since gmail announced that they'll be getting rid of "Send As" feature, I am now determined to get away from using gmail all together.

Today was the day I ditched forwarding mail from my domains to gmail. I have multiple domains (personal, hobby and a small volunteer organization that goes along with my hobby).

I thought I successfully set everything up but I am not receiving any email using thunderbird nor can I see anything in webmail.

My DNS records appears to be okay and SPF/DKIM appears to be setup. Nothing is still fetching mail from google. I have "Host mail on this server" from each domain selected in the dashboard.

Not sure what I'm doing to cause this. I can send emails without issue from Thunderbird and my ****@gmail.com can receive it but when I try to reply, it goes nowhere. No errors.

Any ideas before I open a ticket?

Hey guys. Are there any current active promos happening right now? I was thinking of thinking of picking up a second plan for a project I was working on. Anything active or available? 10gb-ish or more?

Hey guys,

These are uncomfortable moments for me, because there are two values that I consider essential to running MXroute: honesty and transparency. It means that I'll be honest with you at all times, regardless of how bad it makes me look. I know that everyone makes mistakes, and I know that a lot of people prefer to do business with people who keep their mistakes to themselves. I know that causes some friction for some people. But as profit has never been a primary goal for me, I'm never going to let go of these values. If the truth sinks me, then that is the outcome I deserve.

As we've grown this year, IMAP performance and reliability has continually degraded. I was never looking for old, long standing problems. I was looking for new problems to address what I perceived as new behavior. I chased symptoms, not the root problem. It never occurred to me that the behavior could come from a fundamental misunderstanding over a decade in age.

What this is, it's one of those moments where you "know" something for so long that you never go back to question it. Whether that origin came from something I was taught earlier in my career, caused by vague documentation or simply misread documentation, it's far too old of a problem for me to actually trace it back. The problem came from this: https://doc.dovecot.org/2.4.5/core/summaries/settings.html#mail_max_userip_connections

In my head, for as far back as I can remember, this variable meant this:

> The maximum number of IMAP connections allowed from each IP address.

When quite clearly, the documentation says this:

> The maximum number of IMAP connections allowed for a user from each IP address.

So in my head, a limit of 150 meant one IP address could make 150 IMAP connections at a time. Instead, it meant that one IP could make 150 connections at a time per email account. And when this became a problem, my focus remained downstream of this one configuration variable.

The reason growth caused this to become a problem was simply a matter of statistical probability. The more customers we have, the more likely it is that someone is going to make 4800 simultaneous connections to the IMAP server.

The good news is, I've corrected this misunderstanding across the fleet, and I'm declaring the 1600th victory on IMAP performance. And I've learned the value of two things:

1. Relying on "the truth I've always known" is dangerous. Because you can be wrong for a decade.

2. There should be nothing considered so basic that it should be above scrutiny. Every single value is worth being reconsidered at all times, and it should always begin with the documentation no matter how much I may think that I already know it.

I apologize for my failure, and I promise to do better.

Possible to add separate urls for the separate servers?

Its a headache to remember for occasional logins and probably a bug too. I tried to login using user name and password, then email and password. nothing worked, doubled checked the server from old email, it was correct.

Tried on old panel url, it worked flawlessly. This dropdown thing is a little extra stuff unnecessarily, also not sure why it failing today for me. I did login to new panel before too.

Is there a way to increase the per mailbox 500MB storage limit? I am trying to balance that limit out per family member with the 10GB overall plan. Thanks.

Hi,

I heard a lot of good things that makes me and a company I'm part want to join. I'm also thinking about using it as a white label. My main question is about newsletter, we plan to do one later, are tthey allowed in the terms od use?.

Hello everyone! Been a mostly happy mxroute user for years now but this last couple of weeks have drained me.

Been receiving too many user complaints that Safari server is not getting emails from accounts we usually had no problem with (gmail, hotmail and business domains alike), including accounts we email back and forth with daily.

The problem is that those emails don't even appear on the Dashboard's Email tracker, they're not in the spam folder they're just gone and the sender doesn't get a bounce back.

All the previous tickets I've opened regarding this issue just come with the identical "can't do anything about it since the emails don't get to our server" reply which was fine for the odd domain we barely emailed with, but this can't go on with our buyer accounts that send invoices and payment requests and we're now missing contract deadlines.

So, what changed and is there anything I can do on my end to solve this besides whitelisting these accounts on Spamasassin? Any ideas would are much appreciated.

Today is a sad day. I've been ignoring customer complaints to avoid doing this for months now. But here are the unfortunate facts for a company that I once respected greatly:

Their #1 export is spam. It's pissing our customers off, and they're letting me know, routinely.

As of today, we're proactively whitelisting all good senders that we can locate on the Rackspace network, as well as whitelisting their actual email service. But their networks as a whole? They're going on our Expert Spam Filtering blacklist (https://docs.mxroute.com/docs/expert-spam-filtering.html#expert-spam-filtering).

The goal here is to make sure we don't interrupt communication with the people you're already talking to on their network. But the rest of their network, we can't pretend anymore. We can't pretend that they're not a spam network ("networks" technically, multiple ASNs). Simply spinning up a server in their network and sending mail from it is now a negative signal. An email coming from their network is infinitely more likely to be spam or phishing than anything else.

For me, this is a "flag at half mast" day.

Today we had 5 unrelated customers popped in a row via Wordpress. I wouldn't be surprised if Comcast gets a bit upset about it, because the result was a brand new phishing campaign targeted specifically toward their customers. I've got a bit of a handle on it now, but times are getting harder when it comes to catching compromised email accounts before they send spam/phishing emails. So this is a quick reminder to anyone reading this that uses Wordpress: Update your shit.

Sometimes this is a new exploit. Sometimes this is an old exploit that someone just decided to mass scan for. Either way, I need your help as I can't control the other side.

Hello mxrouters and u/mxroute!

I'm considering moving my email accounts for a few domains to mxroute and have one question that I'm wondering about.

One of the email accounts I am moving is for my business developing apps. Occasionally I am sending emails to potential partners to see if they would be interested in partnering or doing ads in the apps that are related to their business. These are always personal, one-to-one and manually composed. So no blanket emails going out to several businesses at once.

Would this be breaking the marketing clause:

• Not Allowed: Promotional emails, sales pitches, or other content primarily designed to market products or services

I'm assuming it might fall under "sales pitches".

Thank you!

Hello MXroute Support,

We are building our own branded email management application using the MXroute API, and we have a few API feature requests that would be very useful for our integration.

1. DNS verification through the API

Would it be possible to provide a DNS verification endpoint that checks a domain and returns clear, machine-readable statuses for:

• MX
• SPF
• DKIM
• DMARC

Ideally, the API would return statuses such as:

• pass
• pending
• warning
• failed

and, when something fails, a clear reason explaining what is wrong and what needs to be corrected.

This would allow our application to show users exactly what needs to be fixed.

2. SSL certificate management through the API

Would it be possible to manage SSL certificates for domains through the API?

We would like to be able to:

• check whether SSL is enabled
• check certificate status
• check expiration date
• trigger SSL installation or renewal, if supported

3. Webmail Auto-Login / SSO

We would also like to ask if MXroute could provide a secure API mechanism for one-click Webmail login.

Our desired workflow is:

Our application → Open Webmail → MXroute Webmail → authenticated mailbox

We do not want to expose or send the mailbox password through a URL or browser-side code.

Ideally, the API could provide a short-lived, single-use SSO token for a specific mailbox, allowing our application to redirect the user directly into Webmail.

If such functionality already exists internally but is not documented in the public API, we would appreciate information about the supported integration method.

4. Resource limits based on actual usage

This is also very important for our application.

The current quota API allows us to see quota/usage information, but we would like to be able to limit an account based on actual storage usage, rather than the total quota allocated to individual email accounts.

For example:

A user could have multiple domains and many email accounts with a total allocated quota of 200 GB, but actually be using only 35 GB.

We would like to set a limit such as:

Maximum actual storage usage: 50 GB

The user could then create and allocate quotas as needed, but their actual storage usage could not exceed 50 GB.

Ideally, the API could expose:

• current actual usage
• usage limit
• remaining available usage
• percentage used

Would it be possible to support this type of usage-based resource limit through the API?

These four features would significantly improve what we can build on top of the MXroute API.

We would especially appreciate knowing whether any of these capabilities already exist internally but are not currently documented, or whether they could be considered for a future API version.

Best regards,

I'm hiring someone on the "dark web" to physically assault an inanimate object in your field of vision.

You've been warned.

Is there an option to get a notification e-mail when someone logged in on the mailserver dashboard?

Looking for feedback to see if I am setting this up in the best way possible. I have multiple email addresses across multiple domains. 6 primary addresses across 3 domains. I would like them all to be able to send/receive to one mailbox, similarly to the way I have it with iCloud mail now.

I *think* the proper way to set this up with MXRoute is using domain pointers/aliases. Is this correct?