DEV Community

ReceiveHQ
ReceiveHQ

Posted on

Anti-spam before webhooks fire: EU DNSRBLs + scoring you control

#inboundemail #webhooks #antispam

I'm Sebastian, CTO at ReceiveHQ (Cortena B.V.). Use-case #4: after fan-out and recipient filters, stop junk from ever hitting your HTTPS handlers.

The problem

Topics 2–3 got one inbound domain onto several webhooks with least-privilege recipient filters. That still leaves a quieter failure mode: every accepted SMTP message that matches a filter becomes a webhook POST.

Spam and phishing shouldn't burn your workers, fill ticket queues, or force every handler to re-implement reputation checks. US-first inbound relays often bury that policy in a black box — or push it onto your app after the POST already landed.

Filter at SMTP and before forward — in the EU

ReceiveHQ's spine stays the same: MIME parsed once on German baremetal, then per-endpoint delivery. Anti-spam sits upstream of that POST:

Layer What it does Where
Optional DNSRBLs Reject / mark at SMTP time against EU-hosted blocklists Per domain
Rule / heuristic scoring Score before forward so borderline mail can stay out of webhooks Per domain
You decide Console or MCP — not a opaque vendor default you can't explain in a DPA review Your tenant

Junk that never forwards never retries. Clean mail still lands in Postmark / Mailgun-SendGrid / CloudMailin (and other drop-in) shapes on the endpoints you already configured.

Why this cut of the story matters

We built ReceiveHQ after years on Postmark inbound — great product, wrong continent — and after deciding finance-critical mail shouldn't share infrastructure with the spammers next door. Fine-grained anti-spam is part of that posture: residency in Germany, short EU-heavy subprocessor list, and controls you can point to when a customer asks what gets through.

Recipient filters decide which of your endpoints see an address. Anti-spam decides whether a message deserves a webhook at all.

Setup sketch

  1. https://receivehq.com — magic-link sign-in
  2. Domain + MX → mx.receivehq.com, verify
  3. Configure domain anti-spam (DNSRBL + scoring) in console or via MCP
  4. Keep existing webhook / blackhole endpoints and recipient filters
  5. Send a known-good test; confirm deliveries with console or list_deliveries

Docs: https://receivehq.com/mcp.md · Trust: hosting · DPA · sub-processors

Next

Retries, resend, and sending the same stored message to different endpoints.

Try: https://receivehq.com · €10/mo or €100/yr · 100k inbound · first 10 free

Disclosure: I work on ReceiveHQ as CTO & Co-founder of Cortena B.V.

Top comments (0)