Correspondence Exchange

Who to write to

Whichever of these you need, please include the complete message with all of its headers. Without them a report usually cannot be acted on.

Unwanted mail, or a forged sender address

abuse@correspondence.exchange

A vulnerability in this system

security@correspondence.exchange

Mail that was delayed, refused or returned

postmaster@correspondence.exchange

Security contact details are also published in the format defined by RFC 9116, at /.well-known/security.txt.

If a message claims to come from this domain

It can be checked, and the check does not require trusting the message. Mail leaving this domain is signed cryptographically using DomainKeys Identified Mail. The domain publishes a Sender Policy Framework record, naming the systems allowed to send on its behalf, and a Domain-based Message Authentication, Reporting and Conformance record, telling receiving systems what to do when a message fails either test.

A message that fails those checks did not come from here, whatever sender address it displays. Please do not act on it, and send it to the abuse address above.

What this system will and will not carry

It accepts messages only for the addresses it serves. It is not an open relay: it will not carry mail from one outside party to another, and attempts to make it do so are refused during the delivery attempt itself. It is not used to send unsolicited bulk mail.

What is recorded

Carrying a message means recording it: who it was from and to, when it arrived, which system delivered it, and whether it was accepted. Those records are kept for a limited period and are used to run the service, investigate abuse and diagnose faults. They are not used for anything else and are not given to anyone else, except where the law requires it. The contents of messages are not read or analysed beyond what delivering them and filtering unwanted mail requires.