How comail handles abuse

Comail is not an open relay: it does not forward mail for unauthenticated third parties. Each sender signs in with an atproto identity, proves control of a sending domain, starts with a low quota, and remains subject to monitoring. The sections below follow the order in which these safeguards apply and distinguish active controls from planned work.

Senders use an atproto identity

Sending through comail requires an atproto DID authenticated over OAuth, and the relay binds each message to that DID. The sender must also prove control of a domain before sending.

This links sending activity to a persistent identity. If a sender breaks the rules, Comail can apply its response to that DID.

You have to prove the domain is yours

comail will not sign or relay a message for a domain until that domain passes DNS verification: the SPF, DKIM, and DMARC records issued during enrollment have to be live and correct. A spammer cannot borrow another sender’s domain reputation, because they cannot publish DNS for a domain they do not control.

The same checks let receivers authenticate comail mail. Each outbound message is DKIM-signed under both the sender’s domain and the operator domain, with RSA-2048 and Ed25519 keys. See DKIM rotation for the signing details.

New senders start slow

A fresh domain cannot send ten thousand messages on day one. The warming schedule caps volume low at the start and raises the ceiling only as the domain shows clean behavior over time. See why warming matters for the mechanics.

These initial limits reduce the amount of mail a new sender can submit before the relay has observed its sending behavior.

Complaint and bounce thresholds can pause sending

Comail processes complaint reports from Microsoft JMRP and Yahoo CFL, and tracks bounces. Comail can pause a domain when its bounce or complaint rate crosses the configured threshold. See Feedback loops for current thresholds.

Public labels record positive reputation

comail runs an atproto labeler. A sender with a clean record earns a clean-sender label, a public atproto record signed by the labeler that anyone can query and any receiving infrastructure can act on. The positive reputation signal lives in the open network, not in a private comail database.

Enforcement against a bad sender works the other way: the relay’s safety system applies an auto_suspended mark that cuts off sending. That mark is internal to the relay rather than a public label, so a suspension does not broadcast a member’s troubles to the whole network while still stopping the abuse. See labels explained for the full set and which labels are public.

Monitoring detects abuse patterns

A behavioral monitor, Sentinel, runs over relay activity and looks for the shapes abuse usually takes: volume spikes, bounce and complaint surges, one sender concentrating on a single recipient domain, duplicated content across many sends, off-hours bursts, and fast ramp-up from a new sender. When a pattern fires, it alerts the operator with enough detail to act.

Sentinel detects, alerts, and assigns graduated risk tiers today. Its red-tier suspension action is controlled by a separate operator kill switch, so detection can keep running while autonomous member-state changes are disabled. Complaint-driven auto-pause, the labeler, and operator review remain independent guardrails.

The sender safety check fails closed

The relay checks each sender against the safety system on every send. If that system is unreachable, comail holds a sender that has no established safety record until the check succeeds, rather than passing the message along unchecked (this fail-closed behavior is specific to the sender safety check; transient DNS-resolver blips are handled separately and do not block sends). Deferring the message is safer than relaying it without a completed check.

What’s still on the roadmap

Two safeguards are planned but not yet available:

• Per-IP blast-radius isolation: a multi-IP sending pool that routes risky or unproven senders onto separate addresses, so one bad actor cannot taint the IP reputation the rest of the cooperative shares. Designed, not yet deployed.
• A public abuse-mitigation summary: aggregate, non-identifying counts of how many senders were paused or suspended in a period and why, so the cooperative’s health stays visible without exposing any member. Under design alongside our privacy commitments.

To report abuse from another sender, or to raise a concern this page does not cover, reach the operator through the contact options on comail.at.