Floods and attacks on the server
DDoS on port 25, connection floods or password guessing against IMAP and mail submission. The server then cannot accept even legitimate mail.
WEDOS.mx receives mail for your domain on the global WEDOS anycast network. It stops attacks, spam and malware before they touch your server, and delivers only what belongs in the inbox. Nothing to install – you just change your MX record.
Anyone can find your mail server's address in DNS. Whoever knows it can flood the server, guess mailbox passwords or send forged invoices to your users. When mail stops, the whole company stops.
$ dig +short MX your-domain.com 10 mail.your-domain.com. $ dig +short mail.your-domain.com 203.0.113.25 # everyone can see this address
DDoS on port 25, connection floods or password guessing against IMAP and mail submission. The server then cannot accept even legitimate mail.
The server has to accept and process every message. Dangerous attachments and links reach your users.
Messages from domains that differ from yours or a partner's by a single character – asking for a “new payment to a different account”.
The foundation is anycast protection of your mail server. On top of it you choose one of three plans for filtering inbound mail. The same network already protects the websites of WEDOS Protection customers.
Your mail server's services get a WEDOS anycast address. Attacks and connection floods are spread across the network and stopped at the nearest PoP. Your server disappears from view.
Your domain's MX record points to WEDOS.mx. We receive the mail, inspect it and deliver only clean mail to your server. What you don't want ends up in quarantine – nothing is ever bounced back to senders.
Pick what is arriving and see where WEDOS.mx catches it – and what happens next.
anywhere in the world
during the session: IP, recipient, country, limits
TLS 1.3, certificates verified on both sides
antispam, antivirus, macros, lookalike domains
nothing is sent back to the sender
receives only clean mail
Whatever can be rejected is rejected during the session. Whatever gets through is inspected in the EU. And you see everything.
Anycast spreads an attack across the whole network, connection limits stop it at the edge.
Spam sources and botnets are rejected before they send the message content.
Mail for addresses that don't exist is never accepted.
Allow only servers in the EU, block selected networks (ASN) or sender domain endings.
Encryption, message size and connection counts – set separately for each domain.
You set the threshold, the default is 75. Every message carries its score in a header.
Depending on the plan, attachments are checked by one, two or three independent antivirus engines.
We detect macros hidden even in files that pose as ordinary .docx or .xlsx documents.
Catches senders impersonating you or your partners – one character changed, a word added.
Suspicious attachments are opened in an isolated environment. It runs on our own infrastructure – attachments never leave WEDOS.
We never send anyone notices about mail they didn't send. No backscatter.
An outage of your server is bridged by a queue in the EU. Unscanned messages are never released, even if antivirus fails.
The defaults protect right away. Every rule can be adjusted or switched off per domain.
Each message has an identifier that follows it all the way. Support can trace what happened to it and why.
Overviews, charts and quarantine. Access for customers and administrators, every change in the audit log.
From public DNS we compute a 0–100 score and tell you what to fix. It works for any domain – even without WEDOS.mx.
Spammers like to deliver straight to the server's old address, around the filter. We test it for you – without sending a single message.
Mailboxes, mail clients and outgoing mail stay the same. Only the path of inbound mail changes.
In the panel you enter the domain and the address of your mail server – that is where we deliver clean mail.
Point MX to mx1.wedos.mx and mx2.wedos.mx. The defaults protect you from the very first message.
Allow port 25 on your server only from WEDOS.mx addresses. The bypass test confirms it.
Spam threshold, countries, quarantine, mandatory TLS – all per domain. But you don't have to.
; domain DNS – today your-domain.com. MX 10 mail.your-domain.com. ; domain DNS – with WEDOS.mx your-domain.com. MX 10 mx1.wedos.mx. your-domain.com. MX 20 mx2.wedos.mx. ; mail server firewall tcp/25 allow WEDOS.mx addresses tcp/25 deny everyone else
Example. The panel shows the exact records and address ranges after you add a domain.
The plans differ in the number of antivirus engines – like the number of eyes watching your mail. Everything else is included in each of them.
For anyone who wants their mail protected – at no cost. One watchful eye.
For companies that want the certainty of two independent antivirus engines. Two faces, two views.
For companies where mail is the main entry point for attacks – finance, manufacturing, public sector. The hundred-eyed guardian.
| Plan comparison | CyclopsFree | Janus7 USD / month | Argus77 USD / month |
|---|---|---|---|
| Anycast mail server protection (IMAP, POP3, submission) | |||
| Rejection during the session – IP, recipient, country, networks | |||
| Antispam with a 0–100 score and your own threshold | |||
| Macros in documents and lookalike domains | |||
| Quarantine instead of bounces | |||
| Antivirus engines | 1 | 2 | 3 |
| Attachment sandbox | – | – | |
| Mail stored and filtered only in the EU |
Working names and prices. Whether pricing will be per domain or per mailbox is still being decided; the commercial antivirus engines and the sandbox are being selected.
Mail is received by the nearest of more than 120 PoPs in the WEDOS network. It is stored and inspected only in the European Union, in WEDOS data centres. Between locations we use TLS 1.3 with certificates verified on both sides – no tunnels, no intermediaries.
We keep accepting mail and hold it in a queue in the EU. We deliver it once your server is back.
We accept the message but don't release it. It is delivered once it has been scanned.
PoPs in the EU accept mail and store it on encrypted disks, PoPs elsewhere switch to a backup in the EU. Nothing gets lost.
No. Only the MX record and the firewall for port 25 change. Mailboxes, passwords, mail clients and outgoing mail stay as they are.
As long as the MX change takes to propagate through DNS. The defaults protect you from the first message WEDOS.mx receives – nothing else to configure.
No. What we don't want is rejected during the session – the sender is then notified by their own server. What we have already accepted and don't want ends up in quarantine. So nobody receives notices about messages they never sent.
It is received by the nearest PoP anywhere in the world, but stored and inspected only in the European Union, in WEDOS data centres. PoPs outside the EU don't store messages.
A filter has to read the message – like any antispam. We terminate connections with our certificate and process messages automatically in the EU, in line with GDPR. We don't send message fingerprints to third-party services unless you switch that on.
You find it in quarantine in the panel and release it. If it happens repeatedly, you adjust the spam threshold or a rule – for the whole domain.
Filtering applies to inbound mail. Sending through your server (ports 587 and 465) is protected by the anycast layer: attacks and connection floods are stopped at the edge and your server still sees the real client IP. WEDOS.mx doesn't read the content of outgoing mail.
The Cyclops has one eye, Janus two faces and Argus a hundred eyes. The number of eyes matches the number of antivirus engines watching your mail. That is why we always state the number of engines next to the name.
WEDOS.mx complements the WEDOS family of services – website protection, content delivery and global anycast infrastructure.