Run it · 17 of 18
Abuse and illegal content
Abuse, illegal content and harassment on an inbuxa server: who is responsible, what the server gives you to find and act on it, and what your users can do for themselves.
On this page
inbuxa is software you run. Coffey Labs does not host your mail, cannot read it and cannot remove it. Whoever runs the server is the provider their users deal with, and is responsible for what happens on it under their local law.
This page is for that person. It covers what to publish, what the server gives you to find and act on abuse, and what your users can do themselves.
Publish where to report it
Give the outside world somewhere to send complaints:
- postmaster@ each of your domains. Mail standards require it.
- abuse@ each of your domains. It's where other providers send complaints about mail from your server.
Read both. When another provider reports spam that came from your server, act on it quickly, or your server's reputation suffers with everyone else's users too. Reports in the standard feedback format (ARF) are recorded as feedback reports.
Finding it
Most abusive mail is spam, phishing or malware, and the spam filter handles it before anyone sees it:
- rules, DNS blocklists and shared digest networks;
- a classifier that learns from what your users mark as spam and not spam;
- optionally, a local AI model as one more signal, run on your own hardware.
For mail your own users send or receive, two rule editors let you set policy:
- Mail flow rules can refuse, redirect or copy messages that match conditions you choose.
- Data loss prevention catches messages that match patterns you define before they leave.
inbuxa doesn't scan mail for images or other content beyond what you configure. That is a decision for each operator, under their own law.
Acting on it
When you learn an account is being used to abuse others, or holds illegal content:
- Preserve the evidence first, if the law requires it. A legal hold keeps everything in the account from being destroyed, by anyone, until you release it. A lock doesn't preserve evidence on its own.
- Stop the account. Lock it: it keeps receiving mail, but nobody can sign in, and it sends nothing.
- Remove it when you're allowed to. Deleting the account removes the mailbox and everything in it.
Every one of these actions is written to the audit log, with who did it and when.
Child sexual abuse material
Many countries require providers to report it and to preserve it for investigators, so don't delete it first. In the United States, a provider serving the public who learns of it must report it to NCMEC's CyberTipline. Don't forward it or copy it anywhere yourself. Take legal advice on what your jurisdiction requires.
What your users can do
People using inbuxa Webmail have their own tools against unwanted mail:
- Report spam moves a message to Junk Mail and teaches the spam filter. Not spam moves it back.
- Filters move or discard mail from anyone they choose: Filter messages like this… on a message, or Settings › Filters & rules.
- Remote images are blocked until they allow them, so a sender can't tell when a message was opened. See Show images in a message.
- Read receipts are never sent without asking (read receipts).
- Masked addresses, where your server offers them, keep someone's real address private. A masked address that attracts abuse can be switched off without changing the real one.
Young users
inbuxa has no public sign-up. Every account is created by an administrator, so you decide who gets one. If you run a server for a family or a school, the safeguards for young users are yours to set: who they can receive mail from, through mail flow rules, and who can see their mailbox, through locks and delegates when there's a reason to.
The project's own spaces
The inbuxa repositories follow a code of conduct. Report abuse or harassment there to communityATcoffeylabsDOTorg. Report security problems in inbuxa itself privately to securityATcoffeylabsDOTorg, never in a public issue.