Spambil
TR Resellers Log in Start free trial
Security

Security and infrastructure

What happens to your mail as it passes through Spambil, where it is processed, and what happens if something goes wrong.

Last updated: 26 September 2026

How mail flows

You set your domain's MX records to spam1.jusbil.com (priority 10) and mx1.spambil.com (priority 20). Every incoming message reaches the Spambil gateway first, is scanned, and if clean is delivered within seconds to your own mail server (cPanel, Plesk, Exchange, Microsoft 365, Google Workspace and so on). Suspicious messages wait in quarantine.

Internet  →  spam1.jusbil.com / mx1.spambil.com (Spambil gateway)  →  your mail server

We don't touch your outgoing mail. It keeps leaving from your own server as usual; Spambil only filters inbound mail.

What we check

  • Sender IP and domain reputation (DNS-based blocklists)
  • SPF, DKIM and DMARC authentication
  • Content analysis and spam scoring
  • Virus and malicious attachment scanning

Where data is processed

  • Mail traffic: processed on our gateway servers in Istanbul, Türkiye.
  • Website and customer panel: served through Cloudflare.
  • Notification emails (login codes, daily digest): sent via SMTP2GO.
  • Payments: Paddle (international, Merchant of Record) and PayTR (Türkiye). Card details never reach Spambil.

We never use your mail content for marketing or advertising. For GDPR, we act as your processor under our Data Processing Addendum. See also our privacy policy.

Connection security

  • Our gateway uses encrypted connections (STARTTLS) with sending and receiving servers that support TLS, with valid certificates for spam1.jusbil.com and mx1.spambil.com.
  • The website and panel are HTTPS-only (HSTS enabled).
  • The panel is passwordless: you sign in with a one-time 6-digit code sent to your email. The session cookie is HttpOnly and HTTPS-only.

Retention

  • Clean mail is delivered to your server; Spambil keeps no copy.
  • Quarantined mail is kept for up to 2 years, then deleted automatically. You or your users can release or delete it earlier.
  • When a subscription ends, your domain is removed from the gateway; remaining data is deleted as described in our privacy policy.

What happens during an outage?

During a temporary outage, SMTP's retry mechanism means mail is normally not lost; delivery may be delayed. How long other servers keep retrying depends on their own settings:

  • If our gateway is unreachable: the servers sending you mail keep it in their own queues and retry at intervals (standard SMTP behavior, typically for up to several days). Mail is delivered once the connection is back.
  • If your server is unreachable: Spambil queues the mail and keeps retrying until your server is back.
  • Emergency rollback: you can point your MX records back to your own server at any time; the change takes effect as DNS propagates (usually minutes). If during setup you blocked direct delivery in Microsoft 365 or turned on "reject all mail not from gateway IPs" in Google Workspace, undo those settings too (setup guide).

We ask you to add both MX records (mx1 and mx2). Today both point to the same gateway infrastructure; an independent second gateway node is planned, and once it's in service no DNS change will be needed on your side.

Access and operations

  • Only our authorized technical staff can access the gateway and customer data.
  • Server software is kept up to date.
  • Each user sees only their own quarantine; customer admins see only their own domains.

Support and emergencies

Reporting a vulnerability

If you believe you've found a security vulnerability in Spambil, email info@spambil.com with the subject "Security vulnerability report". We review every report and get back to you, and we won't take legal action over good-faith reports. Machine-readable contact: /.well-known/security.txt.

Setup

Step-by-step instructions for Microsoft 365, Google Workspace, cPanel and Plesk: Setup guide.