# EMX acceptable use and abuse Mail is only useful while the servers sending it are trusted. One customer sending spam can put our servers on block lists, and then every other customer's mail arrives late or not at all. So the rules are strict, and a report of abuse is acted on quickly. ## What EMX may not be used for The [terms](https://elchi.dev/en/legal/emx-terms), section 6, are binding; in short, EMX may not be used to send: - unsolicited mass advertising, or mail to addresses that were bought, harvested or otherwise collected without consent; - malware, or links to it; - phishing, forged senders, or mail that pretends to come from another organisation; - content that is unlawful to send or to hold, such as depictions of sexual abuse of children, incitement to violence or hatred, or material that infringes the rights of others; - harassment and threats. EMX may also not be used as a relay for other people's mail, resold without an agreement, or probed for weaknesses without our written permission. Newsletters are fine to people who asked for them, with a working unsubscribe link and within the limits below. EMX is not a mass mailing service. ## The limits | Limit | Private | Team | |---|---|---| | Recipients outside EMX per person and hour | 300 | 300 | | Recipients per person and calendar day (counted from midnight Swiss time) | 200 | 1,000 | | Recipients per organisation and calendar month | 1,000 | 30,000 | | Size of one message, attachments included | 50 MB | 50 MB | | Recipients of one message | 100 | 100 | A send over a limit is refused, over the daily or the monthly one with [`daily_limit`](/emx-errors#daily-limit) or [`monthly_limit`](/emx-errors#monthly-limit); nothing is queued to go out later. Receiving is limited only by the size of a message and the mailbox's storage: while a mailbox is full, sending servers are asked to try again later. What our people send is filtered like what they receive: no programs as attachments, and no spam. Going over a limit refuses only that message. A person whose messages are refused again and again as spam or malware is stopped automatically: their mail is refused until an administrator of the organisation, or we, lift the stop. The administrators see the stop and its reason in the administration. ## Reporting abuse Write to **abuse@emxmail.ch**. A report we can act on contains: - the message itself as an attachment (an `.eml` file, or "forward as attachment"), so that its headers are intact; a forwarded copy or a screenshot loses the headers that show where the message came from; - for anything other than a message, such as a phishing page linked from one, the address and the time you saw it. Spam that reaches an EMX mailbox from elsewhere is not abuse of EMX: press **Spam** in the web client, or move it to the junk folder in your mail app. A security problem in EMX itself goes to security@elchi.dev. ## What happens to a report 1. **We read it on the next working day at the latest.** We check the headers first. Mail sent through EMX carries our servers in its `Received` lines and a DKIM signature of the sender's domain made by EMX; mail that only claims to come from an EMX customer does not, and we tell you so. 2. **We find who sent it** and look at the organisation's sending: how much, to whom, and whether the account was signed into from somewhere unusual. 3. **We act, starting with the mildest step that works.** Usually that is a warning to the organisation's administrators with a deadline. Where mail keeps going out, we stop the sending of the person or mailbox concerned, or lower their daily limit, then stop the organisation's. Suspension stops mail from going out; it never deletes anything. 4. **We act at once, without a warning first,** when the mail is malware or phishing, when an account is evidently compromised and sending, or when our servers are being listed on block lists because of it. The administrators are told within one working day, with the reason. 5. **Repeated or serious abuse ends the contract** (terms, 4.5). We answer the person who reported when there is something to say: that the mail did not come from EMX, or that we acted on it. We do not tell a reporter who our customer is. ## What we cannot do - **Pull back mail that was delivered.** A message in someone's mailbox at another provider is out of our reach. - **Read a sealed mailbox.** We act on what the reporter sends us and on what our own logs show, not on the content of a sealed mailbox. - **Decide disputes about content.** Whether a message is defamatory or infringes a right is for a court to decide. We act on a court's order, or where a breach of the law is evident. ## Related - [Requests from authorities](/emx-authorities): how we answer the police, prosecutors and courts, and what data exists. - The [terms](https://elchi.dev/en/legal/emx-terms), sections 6 and 7, are the binding text for everything on this page.