How to set up an inbound SMTP relay with MX records and spam scanning

If your custom-domain email is delivered directly to Gmail, Outlook, iCloud, Yahoo, or another IMAP inbox, you can place an inbound SMTP relay in front of it. This guide shows how to point MX records to Cleanbox, enable spam and virus scanning, forward approved messages to your existing inbox, and verify delivery without migrating accounts.

Prepare your domain and destination inbox

Before changing DNS, collect:

• Access to your domain registrar’s DNS settings
• Your domain name, such as example.com
• The email address that should receive filtered messages
• Access to your current mailbox provider
• A Cleanbox account at cleanbox.app

This setup is a private SMTP relay for a custom domain. Cleanbox receives mail first, applies spam scoring, virus scanning, AI classification, and your rules, then forwards accepted messages to your existing inbox. If you need a broader comparison of gateway approaches, see this guide to putting a spam-filtering security gateway before your inbox.

For example, suppose [email protected] currently delivers directly to Gmail. You can keep Gmail, but route mail for example.com through Cleanbox first. Among email aliases products, favor options that make this step easy to verify.

Configure the inbound relay

1. Sign in to Cleanbox and add your custom domain.
2. Verify domain ownership using the verification method Cleanbox provides.
3. Add the destination address where approved messages should be delivered.
4. Create the addresses you need, such as [email protected] or [email protected].
5. Review the default spam and virus protection settings.
6. Add personal rules for senders, subjects, aliases, or other conditions.

Cleanbox provides an SMTP relay with spam filtering and virus scanning. It uses ClamAV scanning, DNS blocklist checks, rspamd analysis, and an AI layer for signals such as impersonation and social engineering. You can also use rate limits, scheduled delivery, whitelist-only mode, and custom filters. The deciding factor among productivity products is whether they support this exact workflow.

If you are deciding between aliases and a full gateway, aliases are useful for forwarding individual addresses. An inbound relay protects the whole domain because mail reaches the filtering service before your mailbox. You can compare the two approaches in this guide to private email aliases that forward to an existing inbox.

Point MX records to the spam filter

Open your registrar’s DNS editor and locate the existing MX records. Remove or replace records that send mail directly to your old provider, then add the MX hostname and priority shown in your Cleanbox account.

A typical process looks like this:

1. Copy Cleanbox’s required MX hostname exactly.
2. Add it as an MX record for the root domain, often written as @.
3. Enter the priority Cleanbox specifies.
4. Remove conflicting MX records unless Cleanbox instructs you to keep them.
5. Save the DNS changes.

This is the core of an email filtering service using MX records: sending servers look up your domain’s MX records, connect to the listed relay, and only then does the message reach your mailbox. DNS changes can take time to appear, so do not assume the setup failed immediately. MX record changes can be cached by DNS resolvers.

For a custom domain email gateway setup, also review SPF, DKIM, and DMARC requirements shown in your Cleanbox account. Keep existing records unless you know a change is required.

Test delivery and fix common mistakes

Send test messages from:

• A personal address
• A newsletter or transactional sender
• An address that should be blocked or filtered
• An attachment-bearing message, if appropriate

Confirm that each message appears in Cleanbox’s event or message view, receives a spam and malware verdict, and arrives in the destination inbox only when allowed. Check that the original recipient, alias, subject, and headers remain correct.