What is Relay and how does it protect your inbox?
Relay is Cleanbox inbound mail protection for your existing email addresses. Instead of creating new aliases, Relay sits between the internet and your mail server as a filtering gateway — scanning every incoming message for spam, viruses, and threats before forwarding clean mail to your server.
Relay is designed for businesses and professionals who already have email addresses they cannot change (info@yourdomain.com, support@yourdomain.com) but want the same level of protection that Cleanbox aliases provide.
How Relay works
When you enable Relay, you change your domain's MX records to point to Cleanbox. This makes Cleanbox the first stop for all incoming email on that domain:
- Connection — A sender's mail server connects to Cleanbox. The sending IP is immediately checked against DNSBL providers (Spamhaus, Barracuda, SpamCop). Blacklisted IPs are rejected before the message is even accepted.
- Receiving — Cleanbox accepts the message and verifies authentication: SPF, DKIM, and DMARC are all checked.
- Filtering — The message passes through the full Cleanbox filtering pipeline: Rspamd spam scoring, ClamAV virus scanning, your contact states (whitelisted, blocked, muted), and any filter rules you have configured.
- Decision — Based on the combined score and your per-address thresholds, Cleanbox either accepts, quarantines, or rejects the message. The X-Cleanbox-Explanation header is added to accepted messages showing what was detected.
- Forwarding — Accepted messages are forwarded to your actual mail server via SMTP, with the original message preserved intact.
Your email addresses keep working exactly as before. Recipients send to the same address, you receive in the same inbox — Cleanbox is invisible to both sides except for the spam that no longer arrives.
What Relay filters
Relay-protected addresses receive the same filtering as Cleanbox aliases:
| Layer | What it checks | Action on failure |
|---|---|---|
| IP reputation | Sender IP against DNSBL providers (Spamhaus, Barracuda, SpamCop) | Rejected at connection |
| Authentication | SPF, DKIM, and DMARC validation | Score penalty or rejection |
| Spam analysis | Rspamd content analysis, Bayesian classification, header checks | Score-based: accept, quarantine, or reject |
| Virus scanning | ClamAV attachment and content scanning | Rejected |
| Contact states | Your whitelisted, blocked, and muted contacts | Bypass filtering or block |
| Filter rules | Your custom rules (sender, subject, headers, content) | Per-rule action |
You can adjust the spam threshold per address — stricter for a public-facing address like info@, more relaxed for internal addresses. See configuring per-address relay settings for details.
Authentication and forwarding
When Cleanbox forwards a message to your server, it preserves the original message intact — including the sender's DKIM signature. This means your mail server can independently verify that the message was not modified in transit.
To pass SPF checks at your server, Cleanbox uses SRS (Sender Rewriting Scheme) to rewrite the envelope-from address. This is a standard mechanism that ensures the forwarded message passes SPF validation at your destination. Some mail clients may display a "via srs.cleanbox.to" label as a result — see why you see "via srs.cleanbox.to" for a full explanation.
To prevent attackers from bypassing Cleanbox by sending directly to your server, you can configure a relay token. Your server verifies this token on every incoming message and rejects anything that did not pass through Cleanbox. See relay token configuration.
Delivery retries
If your mail server is temporarily unreachable, Cleanbox queues the message and retries delivery automatically. Messages are not lost during brief outages. For details on retry behavior and how to troubleshoot delivery failures, see understanding relay delivery failures and retries.
Relay vs. Aliases
| Aliases | Relay | |
|---|---|---|
| Purpose | Create new email addresses | Protect existing addresses |
| Mail server | Not needed (Cleanbox delivers via IMAP) | Required (Cleanbox forwards to your server) |
| Outbound email | Not supported (receive-only) | Unchanged — you send from your server as before |
| SPF/DKIM/DMARC | Managed by Cleanbox | Your outbound authentication stays untouched |
| Setup | Instant — pick a name and go | MX record change + server configuration |
Relay handles inbound filtering only — your outbound email, sending reputation, and authentication records are not affected.
Getting started
To use Relay, you need:
- A Cleanbox Advanced or Enterprise plan
- Your own mail server (or hosted email that accepts custom MX records)
- Access to your domain's DNS settings
Advanced plans support up to 20 relay-protected addresses per domain. Enterprise plans support up to 100.
Ready to set up? Follow the step-by-step guide: setting up Relay for your domain.
