Now that it’s us based, and important us figures are on the board, why is TikTok still constantly allowing minors and child exploitation?
This guy offers an only fans of his two boys getting busy.
We just shipped version 4 of something that's been quietly changing how we operate our own platform: an MCP (Model Context Protocol) server for RacterMX.
If you're not familiar, MCP is the protocol that lets AI tools (Claude, Cursor, Kiro, etc.) call external services directly. Our npm package @ractermx/mcp-server exposes the full RacterMX API as tools your AI assistant can use. Install with npx, point it at your API key, and your coding assistant becomes your email infrastructure operator.
Here's what that actually looks like in practice:
Example 1: Client onboarding in one prompt
>"I'm onboarding a new client called Acme Corp. Add the domain acmecorp.com to my account, create aliases for info, support, billing, and sales — all forwarding to team@acmecorp-internal.com. Then set up a webhook to notify my Slack integration at https://hooks.slack.com/services/XXX/YYY/ZZZ whenever an email bounces on that domain. Finally, show me the DNS records I need to give them so they can point their MX to us."
One message. The assistant adds the domain, creates 4 aliases, configures the webhook, and returns the DNS records you hand to the client. Seven API calls, zero dashboard clicks, full audit trail.
Example 2: Security audit with auto-remediation
>"Run a security audit across all my domains. For any domain scoring below 90, show me the specific findings that are dragging the score down and tell me which ones you can auto-fix. Then fix anything fixable and re-scan to confirm the scores improved."
The assistant iterates your domains, checks security posture scores, pulls findings on the underperformers, applies one-click DNS fixes (missing SPF includes, weak DMARC policies, missing CAA records), and re-triggers scans to verify. What used to be 30 minutes of clicking through domain tabs becomes a single conversational request.
Example 3: Daily morning briefing
>"Give me a morning briefing: how many emails were processed in the last 24 hours, any bounces or rejections I should know about, any unread security notifications, and check if any of my domains dropped below a B grade overnight."
Run this every morning from your terminal or IDE. The assistant pulls stats, filters for anomalies, checks notifications, and scans security grades; then gives you a plain-English summary. If something's wrong, you can follow up in the same conversation: "Block that sender" or "Show me the full bounce details."
What's exposed:
The MCP server covers the full API surface, domains, aliases, shared domains, SMTP credentials, DNS records, security scans, email logs, webhooks, blocklists, notifications, alert rules, retention policies, and more. Every write operation generates a cryptographically-chained audit log entry, same as if you did it from the dashboard.
Authentication:
Uses a scoped RacterMX API key. You control exactly what the AI can do and you can give it domains:read + aliases:manage and it can create aliases but can't delete your domains. 15 discrete scopes, IP allowlisting, and expiration dates for defense in depth.
Setup:
{
"mcpServers": {
"ractermx": {
"command": "npx",
"args": ["@ractermx/mcp-server@latest"],
"env": {
"RACTERMX_API_KEY": "sk_your_key_here"
}
}
}
}
That's it. Works with any MCP-compatible client.
We just shipped version 4 of something that's been quietly changing how we operate our own platform: an MCP (Model Context Protocol) server for RacterMX.
If you're not familiar, MCP is the protocol that lets AI tools (Claude, Cursor, Kiro, etc.) call external services directly. Our npm package @ractermx/mcp-server exposes the full RacterMX API as tools your AI assistant can use. Install with npx, point it at your API key, and your coding assistant becomes your email infrastructure operator.
Here's what that actually looks like in practice:
Example 1: Client onboarding in one prompt
>"I'm onboarding a new client called Acme Corp. Add the domain acmecorp.com to my account, create aliases for info, support, billing, and sales — all forwarding to team@acmecorp-internal.com. Then set up a webhook to notify my Slack integration at https://hooks.slack.com/services/XXX/YYY/ZZZ whenever an email bounces on that domain. Finally, show me the DNS records I need to give them so they can point their MX to us."
One message. The assistant adds the domain, creates 4 aliases, configures the webhook, and returns the DNS records you hand to the client. Seven API calls, zero dashboard clicks, full audit trail.
Example 2: Security audit with auto-remediation
>"Run a security audit across all my domains. For any domain scoring below 90, show me the specific findings that are dragging the score down and tell me which ones you can auto-fix. Then fix anything fixable and re-scan to confirm the scores improved."
The assistant iterates your domains, checks security posture scores, pulls findings on the underperformers, applies one-click DNS fixes (missing SPF includes, weak DMARC policies, missing CAA records), and re-triggers scans to verify. What used to be 30 minutes of clicking through domain tabs becomes a single conversational request.
Example 3: Daily morning briefing
>"Give me a morning briefing: how many emails were processed in the last 24 hours, any bounces or rejections I should know about, any unread security notifications, and check if any of my domains dropped below a B grade overnight."
Run this every morning from your terminal or IDE. The assistant pulls stats, filters for anomalies, checks notifications, and scans security grades; then gives you a plain-English summary. If something's wrong, you can follow up in the same conversation: "Block that sender" or "Show me the full bounce details."
What's exposed:
The MCP server covers the full API surface, domains, aliases, shared domains, SMTP credentials, DNS records, security scans, email logs, webhooks, blocklists, notifications, alert rules, retention policies, and more. Every write operation generates a cryptographically-chained audit log entry, same as if you did it from the dashboard.
Authentication:
Uses a scoped RacterMX API key. You control exactly what the AI can do and you can give it domains:read + aliases:manage and it can create aliases but can't delete your domains. 15 discrete scopes, IP allowlisting, and expiration dates for defense in depth.
Setup:
{
"mcpServers": {
"ractermx": {
"command": "npx",
"args": ["@ractermx/mcp-server@latest"],
"env": {
"RACTERMX_API_KEY": "sk_your_key_here"
}
}
}
}
That's it. Works with any MCP-compatible client.
One of the biggest friction points we kept hearing: "I want to try email aliasing but I don't have a domain" or "I bought a domain but DNS propagation takes forever and I just want to test this now."
So we built shared domains.
What it is: An assortment of domains available to you to both send and receive email from. Three platform domains — racmx.fyi, ractermx.fyi, and airgap.vip — are now available to every account. Claim any alias instantly (e.g. yourname@racmx.fyi) and it's live immediately. No DNS setup, no domain purchase, no waiting.
How it works:
Sign up → pick a local part on any shared domain → done
Inbound mail forwards to your real address immediately Full DKIM signing, SPF, and DMARC are pre-configured on all three domains Outbound SMTP credentials are generated per-alias if you need to send from the address Everything shows up in your email logs just like a custom domain would What you can do with it:
Sign up for services with a disposable-feeling address that you fully control Test RacterMX before committing to your own domain Keep a permanent privacy alias on a domain you don't have to renew Mix and match — use shared domains alongside your own custom domains Privacy angle: The three domains are intentionally generic. Nobody looking at you@airgap.vip knows what service is behind it or that it's an alias at all.
Billing: You're only charged for shared domains you actually use. If you have aliases on 2 of the 3 domains, you're billed for 2 domains. Zero aliases = zero charge.
No catch: Shared domain aliases have the same forwarding, logging, and SMTP capabilities as custom domain aliases. The only difference is you skip the DNS setup because we handle it.
If you've been on the fence about trying email aliasing, this removes the last excuse. Feedback welcome.
I ordered the M5Stack Official CoreS3 SE IoT Controller w/o Battery Bottom from Amazon, and based on that description I've been searching hard to find 'M5Stack CoreS3 Battery Bottom'.
Does this thing even exist? I cant find it anywhere.
If you’ve ever built a platform that allows users to connect custom white-label domains, you know the absolute biggest customer onboarding bottleneck: DNS propagation anxiety.
We tell our users, "Add this MX and TXT record at your registrar and click verify." They copy it over, jump back to our dashboard, and click verify immediately. Of course, because of standard caching and propagation delays, it fails. They click it more times in frustration. It still fails. Many assume our system is broken and open a support ticket before the records have even had a chance to update.
To solve this friction at RacterMX, we just designed and shipped a live, interactive Geographic DNS Propagation Map right inside our domain settings and Zone Editor.
Here is what it looks like:
We wanted this to be extremely lightweight, native, and load instantly without dragging down the dashboard's page weight with heavy mapping scripts or external APIs.
Instead of clicking an uninformative "Verify" button that fails silently and leaves users in the dark, they can now click "Check Propagation" and visually watch their SPF or DKIM key populate across the globe in real-time.
It turns a tedious, invisible waiting game into a reassuring, visual confirmation. It proves that their configuration changes are actively working, which has completely smoothed out our domain onboarding flow. And you cant deny the war games looking coolness of it...
We would love to hear how other developers and teams are tackling DNS verification friction in their own platforms! Let us know what you think of the map design.
We always wanted a way to actually see where our mail comes from and where it goes.
So we built a Mail Flow Topology page. It's a Sankey diagram that maps:
Line thickness = volume. Red lines = delivery issues (bounces, rejects). You can toggle time windows (24h, 7d, 14d, 30d, 90d) and control how many senders to display.
Some things I've found useful about it:
The visualization also makes it obvious when an alias has become "public" — you see the sender list explode from 2-3 known senders to dozens of randoms.
The UI lets you pick a sender count (20/40/60/100) so it doesn't become unreadable on busy domains.
Would love feedback. Anyone else visualize their mail flow like this?
If you run an MSP or IT consultancy and manage email security for clients, you've probably wanted to put your own brand on the monitoring dashboard instead of showing whatever vendor is behind it. We just shipped white-label support and I want to walk through what it actually looks like to configure.
The white-label system gives you:
app.ractermx.com, your clients log in at yourcompany.ractermx.comportal.yourcompany.com at us with a CNAME, we auto-provision TLS, and your clients never see our domain at allI set this up on a demo account to show the process. The fictional brand is "Carrier Pigeon MX" because why not.
Step 1: Brand name and colors
Under Settings > Branding, you set:
Carrier Pigeon MX#e8682a (the orange from our logo)#1b3a4b (dark teal)#0f1c2e (deep navy)The color picker shows a live preview so you can see how the dashboard looks before saving. The primary color is used for buttons, active states, and highlights. The accent color handles secondary elements. The sidebar background is self-explanatory.
Step 2: Logo upload
You upload four assets:
For our demo, I uploaded the Carrier Pigeon MX logo — a pigeon carrying an envelope, because mail delivery jokes never get old.
Step 3: Vanity URL
You pick a subdomain slug. We chose carrierpigeon, which gives us carrierpigeon.ractermx.com. Your clients bookmark this URL and it's what they see in their browser bar. All the branding (logo, colors, brand name) loads based on which vanity domain is being accessed.
No DNS configuration needed for the subdomain option. It works immediately after you save.
Step 4 (optional): Custom domain
If you want to go fully white-label with no trace of our brand in the URL:
portal.carrierpigeonmx.com)portal.carrierpigeonmx.com → custom.ractermx.comportal.carrierpigeonmx.comThe DNS verification checks for either the CNAME or an A record pointing to our server IP. TLS provisioning happens automatically once DNS is confirmed.
Once branding is active, everything changes:
What stays the same: the actual functionality. Security scans, DMARC reports, reputation monitoring, forwarding — all of it works identically. It's a cosmetic layer, not a feature restriction.
Each organization in the platform can have its own branding configuration. If you manage 10 clients, you could:
The branding resolves based on which vanity domain or custom domain is hit. Same platform, multiple brands, isolated by URL.
The reason we built this: MSPs wanted to offer "email security monitoring" as a service without their clients knowing (or caring) what platform is behind it. You set up the monitoring, you get the alerts, you send the branded reports to clients showing their domain health scores. When they log in to check their DMARC stats or review a security finding, they see your brand.
It also means you can price it however you want. The platform doesn't show our pricing to your end clients. They see your portal, your brand, your reports.
If you're an MSP currently managing email security for clients and want to test how the branding looks, the demo is live at carrierpigeon.ractermx.com. Questions about the implementation or how multi-tenant branding works under the hood are welcome.
There's an RFC from 2018 (RFC 8460) called TLS-RPT that almost nobody has set up, and it solves a visibility problem that most mail server operators don't even realize they have.
The problem: when a sending server connects to your MX over SMTP, it negotiates TLS. If that negotiation fails (expired cert, misconfigured cipher suites, DANE validation error, MTA-STS policy mismatch), the connection either falls back to plaintext or the message bounces. Either way, you have no idea it happened. The sender might get a bounce, or they might silently downgrade to unencrypted delivery. You never see it on your end.
TLS-RPT fixes this. It works like DMARC aggregate reports but for TLS. Receiving servers that support it will send you daily reports listing every TLS connection attempt to your domain, broken down by success and failure, with failure reason codes.
You publish a DNS TXT record at _smtp._tls.yourdomain.com:
v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain.com
That tells sending servers "if you have TLS connection issues reaching my MX, send a report to this address." The reports come in as JSON (or gzipped JSON) and contain:
Google sends one daily. Here's the relevant structure (simplified):
{
"organization-name": "Google Inc.",
"date-range": {
"start-datetime": "2026-07-04T00:00:00Z",
"end-datetime": "2026-07-05T00:00:00Z"
},
"policies": [{
"policy": {
"policy-type": "sts",
"policy-domain": "yourdomain.com",
"mx-host": ["mail.yourdomain.com"]
},
"summary": {
"total-successful-session-count": 847,
"total-failure-session-count": 3
},
"failure-details": [{
"result-type": "certificate-expired",
"sending-mta-ip": "209.85.220.41",
"failed-session-count": 3
}]
}]
}
Three sessions failed because your certificate was expired. Without this report, those 3 connections either bounced or fell back to plaintext and you'd have no record of it on your side.
We added a TLS reporting dashboard that parses these reports and gives you:
The reports arrive at a dedicated mailbox, get parsed by the same pipe that handles DMARC aggregate reports, and land in a per-domain dashboard.
If you've deployed MTA-STS or DANE (and if you care about email privacy, you should have), TLS-RPT is how you know they're actually working. Without it:
The failure types in the reports tell you exactly what went wrong:
| Result Type | What It Means |
|---|---|
starttls-not-supported |
Your MX didn't offer STARTTLS at all |
certificate-expired |
Self-explanatory |
certificate-not-trusted |
Cert chain isn't trusted by sender |
validation-failure |
DANE or MTA-STS verification failed |
sts-policy-fetch-error |
Sender couldn't retrieve your MTA-STS policy file |
sts-webpki-invalid |
Your mta-sts subdomain's HTTPS cert is bad |
Google, Microsoft, and Yahoo all send TLS-RPT reports if you publish the DNS record. They represent the majority of inbound email volume for most domains. Smaller providers are hit or miss, but the big three give you enough coverage to catch problems.
One DNS TXT record. That's it. If you already have DMARC reporting set up, TLS-RPT is the same concept applied to transport security instead of authentication. The data starts showing up within 24-48 hours of publishing the record.
If you use our DNS hosting, the _smtp._tls record is auto-provisioned when you add a domain. The reports get ingested automatically and the dashboard populates itself.
Real examples from our own infrastructure and customer domains:
certificate-expired failures from Google within 24 hours.sts-policy-fetch-error from Microsoft.starttls-not-supported from a specific sender IP range.None of these would have been visible without TLS-RPT. The mail was still flowing in all three cases, just unencrypted.
If you've already set up MTA-STS or DANE, adding TLS-RPT takes 30 seconds and gives you the visibility to know those protections are working. If you haven't set those up yet, TLS-RPT still catches basic TLS failures like expired certs before your users start complaining about missing emails.
Disclosure: I built RacterMX, an email forwarding and domain security platform. TLS-RPT parsing and visualization is one of the features. The record gets auto-provisioned for DNS-hosted domains and reports are displayed in the domain's Security tab. Questions welcome.
If you manage more than a handful of domains, you know the problem: you check everything once, get it all to "A" grade, and then three months later half of it has drifted because someone let a TLS cert expire or a DNS record got deleted during a migration.
We just shipped the Executive Security Summary to solve this. It's a weekly (or on-demand) report that gives you four numbers at the top and a per-domain scorecard below. No clicking through individual domain dashboards.
Top-level metrics:
In my case: A grade, 98.9% pass rate, 7 critical/high findings, 92.6% DMARC compliance across 27 domains.
Below those four numbers is a prose summary that explains the posture in plain language. Something a non-technical stakeholder can read in 10 seconds and understand whether things are fine or on fire.
Trend indicators:
Three buckets: Improving, Stable, Declining. For my portfolio this week: 0 improving, 24 stable, 3 declining. That immediately tells me I have three domains I need to look at without reading anything else.
Domain Scorecard:
A table with every domain, its current grade, a trend arrow (improving/stable/declining), and the single most important finding for that domain. Examples from my report:
frplumber.com — A, stable, LOW: shared IP used by multiple sendersfrplumbingllc.com — A, declining, HIGH: TLS certificate expires in 30 daysknauss-family.com — A, declining, MEDIUM: SOA MNAME does not resolveplumberfresnoca.com — A, declining, HIGH: TLS certificate expires in 30 daysracterholding.com — A, stable, MEDIUM: domain is only 16 days oldThe declining arrow on two domains both pointing at TLS cert expiry means I know exactly what to go fix today. Before this report I would have found out when the cert actually expired and mail started bouncing.
Security scoring tools are great at telling you the state of one domain at one point in time. They're bad at answering "is my portfolio getting better or worse?" and "which domains need attention this week?"
This report is designed to be the thing you glance at Monday morning, or forward to your manager when they ask "are we secure?" The answer is right there: A grade, 98.9% passing, 3 domains trending down, here are the specific findings.
For MSPs managing client domains, this is the report you send to clients. For internal IT teams, this is the report you bring to your weekly security standup.
The report pulls from the same continuous scanning that powers our per-domain security checks. It aggregates findings across all domains in your organization, calculates trends by comparing current scores to the previous period, and ranks findings by severity.
You can generate it on-demand (hit Refresh) or get it delivered on a schedule. The date range in the header shows what period it covers.
Under the organization dashboard. If you have domains already being monitored, your first report generates immediately.
For anyone not familiar with the rest of the platform: RacterMX does email forwarding and domain security monitoring. The monitoring side continuously scans your domains for SPF, DKIM, DMARC, MTA-STS, DANE, DNSSEC, TLS, blacklist status, and a bunch of other signals. This executive summary rolls all of that up into a single view.
Questions welcome. Especially interested in feedback from people managing 10+ domains on what metrics you'd want to see in a report like this.
We just shipped the Attack Surface Map, a new visualization under the Security tab that shows your complete email infrastructure topology, protection coverage, and exposure points in one view.
At the top, you get a single number: attack surface covered. This is the percentage of known email protection layers that are active for your domain. 8/8 means every standard defense is in place — SPF, DKIM, DMARC, MTA-STS, DANE, TLS-RPT, CAA, and DNSSEC.
The topology diagram traces the actual path mail takes to reach your inbox:
Senders → SMTP/TLS → mail.ractermx.com → deliver → your domain → forward → Destinations
This isn't theoretical. It maps your real infrastructure — which MX handles inbound, where mail gets delivered, and where it forwards to. Below the flow, you can see supporting services like DNS hosting (PowerDNS authoritative in this case).
If you have multiple MX records, forwarding destinations, or SMTP credentials, they all appear in the topology. You see the full picture of what's exposed to the internet.
Every protection layer that guards your mail flow is listed with its current status. Active means the protocol is configured and passing validation. Missing means there's a gap an attacker could exploit.
In this screenshot, all 8 layers are active — that's the goal. When something drops off (say your MTA-STS policy expires or a DKIM key gets rotated without updating DNS), it immediately shows as a gap here.
The bottom section quantifies your attack surface:
Each metric has a risk indicator. More aliases and catch-all enabled means more surface area for spam and phishing to land.
Security scanners tell you what's broken. They don't show you what's exposed. A domain with 1 alias and no catch-all has a fundamentally different risk profile than one with 50 aliases and catch-all enabled — even if both score 100 on protocol checks.
The Attack Surface Map combines topology (how mail flows), coverage (what's protecting it), and exposure (how much surface area exists) into a single view. It answers the question: "If someone wanted to attack this domain's email, what would they see?"
Available now for all domains under Security → Attack Surface.
We just shipped Domain DNA, a new visualization under the Security tab that gives you a complete picture of your domain's email security posture in one view.
The radar chart maps your domain across six dimensions — Authentication, Encryption, Reputation, Shadow Surface, Policy, and Infrastructure — with a composite Genome Score (0–100) at the center. You can immediately see where your domain is strong and where it has gaps.
Next to the radar, Security Traits shows which protocols are active (green dot) vs. missing (gray). SPF, DKIM, DMARC, MTA-STS, DANE, DNSSEC, CAA, BIMI, TLS-RPT, MX, DNSBL, and Cert status — all in one place without clicking through tabs.
The pillar breakdown bars below the radar give exact scores per dimension. In the screenshot you can see this domain scores 100 across the board except Policy at 50 — meaning DMARC policy could be stricter (probably p=none instead of p=reject).
Genome Mutations tracks changes over time. Every scan that alters your security profile gets logged so you can see drift — like if someone accidentally removes a DKIM key or your TLS cert lapses.
Most email security dashboards give you a checklist. Pass/fail, green/red. That's useful but it doesn't tell you the shape of your security posture. Two domains can both score 85 but have completely different risk profiles — one might be strong on authentication but weak on encryption, the other the reverse. The radar chart makes that instantly visible.
It also makes conversations with stakeholders easier. Instead of explaining what DANE and MTA-STS are, you can point at the chart and say "we're solid everywhere except Policy — here's the one thing to fix."
Available now for all domains under Security → DNA.
There are two competing standards for enforcing TLS on email delivery: DANE (RFC 6698) and MTA-STS (RFC 8461). I implemented both on my mail infrastructure and want to share what I learned about the practical differences, because I think the community discussions often miss the nuances.
The threat model:
Without either standard, SMTP uses "opportunistic TLS" — the sending server tries STARTTLS, but if it fails (or a MITM strips the STARTTLS response), the message falls back to plaintext. An active network attacker between two mail servers can:
Both DANE and MTA-STS aim to prevent these attacks, but they do it very differently.
DANE (DNS-Based Authentication of Named Entities):
How it works:
Strengths:
Weaknesses:
smtp_tls_security_level = dane.MTA-STS (Mail Transfer Agent Strict Transport Security):
How it works:
_mta-sts.yourdomain.com) signaling that a policy existshttps://mta-sts.yourdomain.com/.well-known/mta-sts.txtStrengths:
mode: testing with TLS-RPT lets you monitor before enforcingWeaknesses:
mta-sts.yourdomain.com and a web server to host the policy file.What I run:
Both. DANE for servers that support it (Postfix-to-Postfix, Microsoft). MTA-STS as the fallback for everyone else (mainly Gmail). My outbound delivery uses smtp_tls_security_level = dane which means:
For inbound, I publish both TLSA records (DANE) and an MTA-STS policy in enforce mode. Senders that support either one will verify my certificate properly. Senders that support neither still get opportunistic TLS.
The frustrating reality:
Neither standard has universal adoption. DANE requires DNSSEC which most registrars make difficult to configure. MTA-STS is simpler but the major senders (Gmail, Microsoft) only adopted it in the last few years. In practice, most email between two random domains is still opportunistic TLS with no certificate verification.
If you care about email privacy and run your own infrastructure: implement both. The effort is worth it for the subset of correspondents whose servers actually check.
What's your setup? Does anyone here run DANE only, MTA-STS only, or both? I'm curious what the practical adoption looks like from the receiving side — what percentage of your inbound mail comes from senders that actually verify?
Disclosure: I run RacterMX, an email forwarding service. DANE + MTA-STS are both live on the infrastructure, and we also auto-provision MTA-STS policies for customer domains that use our DNS hosting.
If you forward email from a custom domain to Gmail or Outlook, you've probably noticed that some messages get flagged or sent to spam even though the original sender had valid DKIM.
When you forward an email, the forwarding server often needs to modify headers. Maybe it adds a List-Unsubscribe proxy, maybe it rewrites the envelope sender for SPF (SRS), or maybe it just adds a Received: header in the wrong spot. Any modification to a DKIM-signed header field invalidates the signature.
So now the message arrives at Gmail with:
What doesn't work:
p=reject in their DMARC record and your DKIM signature doesn't align, SPF alone won't save you.What actually works: ARC (Authenticated Received Chain)
ARC (RFC 8617) was designed specifically for this. Before you modify anything, you:
ARC-Authentication-Results headerARC-Message-SignatureARC-SealNow when Gmail receives the forwarded message, it sees:
The implementation order matters:
I'm sure your thinking Duh, "You have to sign after all modifications are complete.". This sounds super easy in principle, but in reality there are a TON of changes being made by a number of different components so making sure your at the end of that chain was non-trivial. In my Postfix setup, the flow is:
non_smtpd_milters fires on the re-injected message → rspamd applies DKIM + ARC signatures nowIf you sign at step 1 and modify at step 2, your own signature is immediately invalid. The re-injection pattern with signing only on non_smtpd_milters is what makes this work.
The catch:
ARC only helps if the receiving server evaluates it. Gmail and Microsoft both do. Smaller providers mostly don't. So you still need SRS for SPF as a fallback, and you should still minimize header modifications to keep the original DKIM intact when possible.
Questions for the community:
Disclosure: I built an email forwarding service (RacterMX) — this post is based on problems I encountered and decisions I made while building it. Happy to answer questions or hear how others have solved these differently.
I keep seeing people recommend ProtonMail, Tutanota, or burner accounts when someone needs to send email without revealing who they are. The problem: you're locked into their app, you need a whole separate account.
I built something different into RacterMX. It's a full sender anonymity proxy that works with any standard SMTP client — Gmail "Send As", Thunderbird, Apple Mail, whatever you already use.
How it works:
reply+a8f3bc91d@yourdomain.comThe proxy addresses are:
The key difference from ProtonMail/SimpleLogin/AnonAddy:
This can use any domain you own, and if you dont want your domain associated with the email, we give you the option to use our proxy domain (FrontMyMail.com).
Use cases I've seen so far:
It's not encryption (use PGP for that). It's identity isolation — the email works normally, passes all authentication checks, but the human behind it is invisible.
Anyone else solving this problem differently? Curious what approaches people use for sender anonymity that doesn't involve a walled-garden app.
If you manage email infrastructure for multiple clients (MSP, agency, consultancy), you know the pain of keeping domains, permissions, and monitoring separate but manageable.
RacterMX supports full hierarchical organization management:
Combined with our Terraform provider, you can template a standard setup (domain + aliases + webhooks + alert rules + security overrides) and replicate it across clients in seconds.
It's designed for the "I manage 200 domains across 30 clients" use case where a flat domain list stops working.
Email deliverability is a black box for most people. You send emails, some bounce, maybe you're on a blacklist somewhere, and you find out when customers say they never got your messages.
RacterMX now includes full reputation monitoring:
Reputation Score — Composite 0–100 score with component breakdown:
Blacklist Monitoring — Active scanning across major DNSBLs. Current listings, historical events, per-IP tracking.
DMARC Analysis — We ingest aggregate reports and show you:
none → quarantine → reject)Alert Rules — Set thresholds on any metric. Get notified via email or webhook when your reputation degrades, you get blacklisted, or DMARC compliance drops.
One of the less obvious features in RacterMX: anonymous reply proxying.
The problem: you forward emails from contact@yourdomain.com to your personal Gmail, but when you reply, Gmail shows your real address. Not great for privacy, support aliases, or when you're managing dozens of domains.
The solution: when forwarding is configured with SMTP credentials and anonymous reply enabled, the system generates a time-limited proxy address. The recipient sees the proxy address in reply-to headers. When they reply, it routes back through your domain without ever exposing your real inbox.
Proxies are:
It's a privacy layer on top of standard email forwarding. Useful for support aliases, marketplace communications, or anyone who wants forwarding without the reply-address leak.
We just published the first version of a Terraform provider for managing RacterMX — covers domains, aliases, DNS zone records, security checks, alerts, organizations, the whole stack.
On the registry: https://registry.terraform.io/providers/racter-ciso/ractermx/latest
What you can manage as code:
15 resources: domains, aliases, zone records, webhooks, blocklists, SMTP credentials, API keys, alert rules, organizations, tags, retention policies, security check overrides, etc.
10 data sources: security score, DMARC compliance, reputation, statistics, quotas, DNS records
Quick example:
terraform {
required_providers {
ractermx = {
source = "racter-ciso/ractermx"
version = "~> 0.1"
}
}
}
resource "ractermx_domain" "example" {
name = "example.com"
max_aliases = 100
}
resource "ractermx_alias" "info" {
domain_id = ractermx_domain.example.id
local_part = "info"
forward_to = "team@company.com"
}
resource "ractermx_zone_record" "txt_verification" {
domain_id = ractermx_domain.example.id
name = "@"
type = "TXT"
content = "google-site-verification=abc123"
ttl = 3600
}
resource "ractermx_alert_rule" "blacklist" {
domain_id = ractermx_domain.example.id
name = "Blacklist Alert"
alert_type = "blacklist_change"
condition = "any_change"
channels {
channel_type = "email"
email_address = "ops@company.com"
}
}
We also have a Model Context Protocol server (@ractermx/mcp-server on npm) if you'd rather give an LLM agent direct API access. Same surface area, different interface.
Feedback welcome — happy to iterate on the resource schema before we hit v1.0.
Hey everyone,
If you’ve been on the fence about trying out RacterMX or need a solid reason to spin up some new services, we’ve got a massive hookup for the community.
We just launched a brand new promo code specifically for new customers: LoveYouLongTime2026
What you get: $100 in instant service credit added straight to your account.
Valid for any new accounts signing up this month.
Perfect for testing out performance, hosting projects, or benchmarking your setups without touching your wallet.
How to claim it: Head over to the sign-up page.
Drop LoveYouLongTime2026 into the promo/coupon code field during registration.
Your $100 credit will be applied immediately.
Quick Note: This is strictly for new customers starting their first accounts. If you run into any issues getting the credit to apply, drop a comment below or hit up support and we'll get it sorted for you.