Why do I see "via srs.cleanbox.to" in my email?
When Cleanbox Relay forwards email to your mail server, some email clients display a small label like "via srs.cleanbox.to" next to the sender's name. This is normal and expected — it means the message was properly forwarded through Cleanbox.
Why the label appears
To deliver email reliably, Cleanbox uses a standard called SRS (Sender Rewriting Scheme). When an email arrives from, say, alice@example.com, Cleanbox rewrites the envelope sender (the technical return address used for bounce handling) to an encoded bounce address like SRS0=hash=tt=example.com=alice@srs.cleanbox.to. This is not a real mailbox — it is a routing mechanism that ensures bounces find their way back to the original sender through Cleanbox.
This rewriting is necessary because of SPF. Without SRS, your mail server would see the email arriving from Cleanbox's IP address but with an envelope sender of alice@example.com. Since Cleanbox's IP is not listed in example.com's SPF record, the SPF check would fail — and your server might reject the email or move it to spam.
SRS solves this by moving the envelope sender into Cleanbox's own infrastructure domain, which does list Cleanbox's IPs in its SPF record. SPF passes, and the email is delivered normally. If the email bounces, Cleanbox decodes the SRS address and forwards the bounce notification to the original sender.
What email clients are reacting to
Some email clients compare the From header (the sender's name and address you see) with the envelope sender (the technical return address). When these two use different domains, certain clients show a "via" label to indicate the mismatch:
| Email client | What you see |
|---|---|
| Gmail (web) | "via srs.cleanbox.to" next to the sender name |
| Google Workspace | Same "via" label in the message header area |
| Apple Mail | Usually does not show a "via" label |
| Outlook | Usually does not show a "via" label |
| Thunderbird | Usually does not show a "via" label |
Gmail is the most common client to display this label. If your mail server delivers to Gmail or Google Workspace inboxes, you are most likely to see it.
Is this a security concern?
No. The "via" label is informational, not a warning. It simply indicates that the message was forwarded through a different server than the original sender's — which is exactly what Relay does by design. The email is legitimate, properly authenticated, and was filtered by Cleanbox before delivery.
The original sender's DKIM signature is preserved during forwarding, so the destination server can still verify that the message content has not been modified in transit.
Can I remove the label?
The "via" label is controlled entirely by the recipient's email client. Cleanbox cannot suppress it because it is a client-side decision based on comparing the From header with the envelope sender.
The label appears because SRS is the correct way to handle forwarding under SPF. The alternative — not rewriting the envelope — would cause SPF failures at your destination server, which leads to rejected or spam-classified email. That is a much worse outcome than a cosmetic label.
If the label is a concern for your organization, you can inform your team that emails showing "via srs.cleanbox.to" are legitimate messages that were filtered and forwarded by Cleanbox Relay.
Technical summary
Here is what happens to a message from alice@example.com when it passes through Relay:
| Header | Value | Explanation |
|---|---|---|
| From | alice@example.com | Original sender — unchanged |
| Return-Path | SRS0=hash=tt=example.com=alice@srs.cleanbox.to | SRS-encoded bounce address for SPF compliance |
| DKIM | Signed by example.com (original) + cleanbox.to (relay) | Both signatures intact, same body hash |
| SPF | Pass | Checked against Cleanbox's infrastructure domain, which lists the relay IPs |
For more on how Relay forwards email, see What is Relay and how does it protect your inbox?
