According to a post in its official forum, Mailbox.org does not properly implement anti-spoofing measures (SPF/DKIM/DMARC) for custom domains, meaning anyone with a Mailbox.org account can send mail from another users email address. This issue was confirmed by Mailbox.org four years ago, with unful…

DMARC policies don’t work or aren’t respected with custom domains. I had tried with p=reject and p=quarantine but yet, I was able to recieve emails with my own email address and the email wasn’t sent to spam (should have been with p=quarantine). So, my email address was successfully spoofed. I did …

[image] anon35626300: I did the test using emailspooftest.com Ah that is quite a good test. I tried with: v=DMARC1;p=quarantine;rua=mailto:postmaster@example.com;ruf=mailto:hostmaster@example.com Seems it failed on two tests: BEC fake insider protection - Vunerable: :Failed :system di…

[image] dngray: Domain attack protection - Vulnerable: :Failed :Domain attacks delivered This should never get into your inbox. This vulnerability allows attackers to impersonate any email-restricted domain and is commonly used to trick users into clicking ransomware and malware. This is th…

Would love to, but not public. Concerned about the possibility of a vulnerability in the custom domain. Don’t forget that we discuss [image] plonkeyt: anti-spoofing measures (SPF/DKIM/DMARC) for custom domains If the moderators of the forum or professionals will advise what may be the proble…

[image] dngray: It did however pass on all other tests with A. Deliverability test - Validated: Grade: A Fake subdomain protection - Enforced: Grade: A Look-a-like protection - Enforced: Grade: A Subdomain attack protection - Enforced: Grade: A I wonder how other providers we recommend compar…

yeah test results of other providers would be helpful in determining how mailbox.org compared in security with others listed.

well, apparently not in this thread, I think we should take the leader’s decision with an open mind and create a separate thread

So, mailbox.org is safe as long as you’re using their default domain?

Yes except they recycle their domain.

Further reason to remove Mailbox.org is its weird implementation of 2FA. It requires you to change your password to a four character pin, and then add the 2FA code to the end of the password when logging in. A couple months of ago they released a BETA version with normal 2FA . But this was 5+ years …

Privacy Guides Community

Remove Mailbox.org

Site Development Tool Suggestions

anon23293884 August 28, 2024, 2:29pm 23

I literally responded with my testing to this comment in this thread…

Email providers anti-spoofing comparison (Proton vs Tuta vs Mailbox.org)

Topic		Replies	Views
Email providers anti-spoofing comparison (Proton vs Tuta vs Mailbox.org) General	3	2558	September 11, 2024
Mailbox.org has released Login 2.0 General article	14	2533	July 11, 2025
Why would a big e-mail provider choose to allow spoofing? Questions	4	575	June 13, 2026
Advice needed: Spamhaus blocklisting Njalla domains General	5	1035	September 16, 2025
Using Posteo w/a Custom Domain? Questions	12	3705	February 27, 2026

Privacy Guides

Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.

Privacy Guides is a non-profit, socially motivated website that provides information for protecting your data security and privacy.

We do not make money from recommending certain products, and we do not use affiliate links.

Knowledge Base

Private Web Browsers

Top VPN Providers

Privacy-Respecting Services

Software Recommendations

More Resources

Remove Mailbox.org

Related topics