Inbound MX protection for your domain.
Route your domain's email through Cleanbox. We filter spam with AI, scan for viruses, check blacklists, and forward clean messages to your mail server — no credentials needed, just a DNS change.
Everything happens before delivery
Unlike inbox-level filters that sort email after it arrives, Relay intercepts threats at the MX level. Spam, viruses, and blacklisted senders never reach your server.
Protection without migration
Keep your existing email addresses. Just change your MX records and Cleanbox filters everything in front of your server.
Virus scanning included
ClamAV scans every attachment for malware, trojans, and ransomware before forwarding.
Never lose an email
If your server goes down, the retry queue holds messages for up to 4 days and delivers automatically when it recovers.
Multi-layer spam detection + AI
Every email passes through Rspamd (Bayesian classification, SPF/DKIM/DMARC, URL reputation, fuzzy hashing) and Cleanbox's AI content classifier that understands context — catching brand impersonation, sextortion, and social engineering that statistical filters miss.
Set two independent thresholds per address: a quarantine threshold for borderline messages and a reject threshold for obvious spam.
- Per-address configurable thresholds with quarantine zone
- AI explains its reasoning via
X-Cleanbox-Explanationheader - Crowd-sourced sender reputation across all Cleanbox users
ClamAV virus scanning + IP blacklists
Every inbound email is scanned by ClamAV for viruses, trojans, ransomware, and malicious scripts. The sender's IP is checked against Spamhaus, Barracuda, and SpamCop. Both happen before spam scoring — threats are caught at the earliest possible stage.
- ClamAV signatures updated multiple times per day
- Real-time DNSBL lookups against multiple providers
- 11 configurable spam symbol rules (SPF Fail, DKIM Reject, Zero Font, etc.)
The evaluation chain
Every email passes through these steps in order. The first match wins — threats are caught at the earliest possible stage.
Contact intelligence + Shield on relay
Every sender becomes a contact with automatic categorization (20 categories) and a manageable state. Whitelist trusted senders, block spammers, mute noisy contacts. Protect relay addresses with Shield: rate limiting, delivery scheduling, and Gatekeeper whitelist-only mode.
- 5 contact states that affect the entire evaluation chain
- Shield rate limiter, snoozer, and gatekeeper per address
- One-click newsletter unsubscribe (RFC 8058)
Verification token + retry queue
Prevent email from bypassing Cleanbox with a unique X-Cleanbox-Validation token header. Configure your mail server (Exim, Postfix, Dovecot) to reject email without it. If your server is temporarily down, the retry queue holds messages with exponential backoff for up to 4 days — zero email loss.
- Unique 64-character token per relay domain
- 11 retry attempts over ~4 days (5min → 48h backoff)
- SRS envelope rewriting for SPF alignment
Zero outbound changes
Relay is inbound-only. Your SPF, DKIM, and DMARC records stay untouched. Your sending reputation remains 100% yours.
Protect your domain in 5 minutes
Change your MX records, register your addresses, done. Available on Advanced ($35/mo) and Enterprise ($100/mo) plans.
Get started