EMX acceptable use and abuse

Mail is only useful while the servers sending it are trusted. One customer sending spam can put our servers on block lists, and then every other customer's mail arrives late or not at all. So the rules are strict, and a report of abuse is acted on quickly.

What EMX may not be used for

The terms, section 6, are binding; in short, EMX may not be used to send:

unsolicited mass advertising, or mail to addresses that were bought, harvested or otherwise collected without consent;
malware, or links to it;
phishing, forged senders, or mail that pretends to come from another organisation;
content that is unlawful to send or to hold, such as depictions of sexual abuse of children, incitement to violence or hatred, or material that infringes the rights of others;
harassment and threats.

EMX may also not be used as a relay for other people's mail, resold without an agreement, or probed for weaknesses without our written permission. Newsletters are fine to people who asked for them, with a working unsubscribe link and within the limits below. EMX is not a mass mailing service.

The limits

Limit	Private	Team
Recipients outside EMX per person and hour	300	300
Recipients per person and calendar day (counted from midnight Swiss time)	200	1,000
Recipients per organisation and calendar month	1,000	30,000
Size of one message, attachments included	50 MB	50 MB
Recipients of one message	100	100

A send over a limit is refused, over the daily or the monthly one with daily_limit or monthly_limit; nothing is queued to go out later. Receiving is limited only by the size of a message and the mailbox's storage: while a mailbox is full, sending servers are asked to try again later.

What our people send is filtered like what they receive: no programs as attachments, and no spam. Going over a limit refuses only that message. A person whose messages are refused again and again as spam or malware is stopped automatically: their mail is refused until an administrator of the organisation, or we, lift the stop. The administrators see the stop and its reason in the administration.

Reporting abuse

Write to abuse@emxmail.ch. A report we can act on contains:

the message itself as an attachment (an .eml file, or "forward as attachment"), so that its headers are intact; a forwarded copy or a screenshot loses the headers that show where the message came from;
for anything other than a message, such as a phishing page linked from one, the address and the time you saw it.

Spam that reaches an EMX mailbox from elsewhere is not abuse of EMX: press Spam in the web client, or move it to the junk folder in your mail app.

A security problem in EMX itself goes to security@elchi.dev.

What happens to a report

We read it on the next working day at the latest. We check the headers first. Mail sent through EMX carries our servers in its Received lines and a DKIM signature of the sender's domain made by EMX; mail that only claims to come from an EMX customer does not, and we tell you so.
We find who sent it and look at the organisation's sending: how much, to whom, and whether the account was signed into from somewhere unusual.
We act, starting with the mildest step that works. Usually that is a warning to the organisation's administrators with a deadline. Where mail keeps going out, we stop the sending of the person or mailbox concerned, or lower their daily limit, then stop the organisation's. Suspension stops mail from going out; it never deletes anything.
We act at once, without a warning first, when the mail is malware or phishing, when an account is evidently compromised and sending, or when our servers are being listed on block lists because of it. The administrators are told within one working day, with the reason.
Repeated or serious abuse ends the contract (terms, 4.5).

We answer the person who reported when there is something to say: that the mail did not come from EMX, or that we acted on it. We do not tell a reporter who our customer is.

What we cannot do

Pull back mail that was delivered. A message in someone's mailbox at another provider is out of our reach.
Read a sealed mailbox. We act on what the reporter sends us and on what our own logs show, not on the content of a sealed mailbox.
Decide disputes about content. Whether a message is defamatory or infringes a right is for a court to decide. We act on a court's order, or where a breach of the law is evident.

Requests from authorities: how we answer the police, prosecutors and courts, and what data exists.
The terms, sections 6 and 7, are the binding text for everything on this page.