Skip to main content

Introduction

The SMTP Data Channel configuration applies to the following situations:
  • Reports sent to the abuse@ role address, including abuse web form submittals from your website
  • Reporting abusive behavior to Abusix
  • Spam trap emails
  • Emails reported as spam by users in your mail platform
  • Other (e.g., reports of abuse to be routed to network or DNS operations through Abusix Global Reporting)
⚠️ Sending data via the API using the XARF field format is recommended, as it ensures the data can be processed and used immediately.
Learn more about sending data to our API.

Email Formats

Using standardized formats increases the chances of your data being parsed automatically. The ideal email formats are MARF and XARF for SMTP. These standards make report handling automatic and should be followed whenever possible. However, we also support other formats, such as:
  • Shadowserver format
  • IODEF
  • TAXII
  • Others
⚠️ There are cases where data may not be parseable. For example, when an issue applies to an entire ASN, it’s not helpful to create an event for every single IP address.
Please contact support if you have questions.

Configuring an SMTP Data Channel

To set up your Data Channel in app.abusix.com:
  1. Click Settings in the left menu, then Data Channels.
  2. Create a new Data Channel.
  3. Under Choose how you would like to start, select what you want to do with the data.
  4. Under How would you like to send the data?, select Send data using SMTP forward.
  5. Under Tell us some details …, select the data type: Send abuse reports, Mail from a spam inbox, Mail caught in spam traps, or Other. The sections below describe each type.
  6. Name your Data Channel, choose what Abusix is allowed to do with the data, and click Finish.
The summary page shows the SMTP address to send your data to.

Sending Abuse Reports by Email

Aliasing Your abuse@ Role Address(es)

Abuse reports sent to the abuse@ role address should be forwarded by aliasing that address to the SMTP address of your Data Channel. If you’re using a different email address (not abuse@), alias that address to the Data Channel SMTP address as well. See Forwarding Your Abuse Data for step-by-step aliasing instructions, and Event Types for the types of abuse Abusix can identify.
❗ Forwarding from an email client does not work!
Always use aliasing. Forwarding from an email client modifies the message (e.g., adds headers or rewraps the message), which prevents proper parsing.

Forwarding Abuse Reports from Web Forms or Internal Platforms

  • If possible, avoid using email for internal reports. Instead, submit them via our API using a XARF schema.
  • If email is required (e.g., from a web form or system-generated alert), use XARF for SMTP formatting.
Avoid sending bulk abuse emails, as they are resource-intensive to parse and maintain. Instead, use fire-and-forget integration via the API where possible.

Reporting Abusive Behavior to Abusix by Email

Under Choose how you would like to start, select Report abusive behavior to report spam, attacks, malware and copyright infringements to Abusix. We check which network is affected so the responsible owner can be notified. When you finish the setup, you choose what Abusix is allowed to do with the data, for example using it to send abuse reports to Abusix customers for the sole purpose of abuse management.

Forwarding Spam Trap Emails

When configuring your Data Channel, select the data type: Data Type: Mail caught in spam traps Requirements:
  • Email addresses must only be genuine spam traps that should never receive legitimate mail.
  • Forward trap hits directly. Do not repackage the message in an envelope.
  • The envelope FROM should reflect the original sender of the message (not your system).
  • If redaction or anonymization is required, the original format must be preserved with all headers intact.
❗ If you cannot preserve the original message, attach the x-originating-ip header containing the malicious sender’s IP.

”This Is Spam” User Reports

When configuring your Data Channel, select the data type: Data Type: Mail from a spam inbox Requirements:
  • These are spam reports generated by users clicking “This Is Spam” buttons in their email UI.
  • Reports should be sent as attachments inside an envelope report email.
  • Include these headers where possible:
    • x-originating-ip: IP address of the original sender
    • x-original-from: Original envelope FROM value

Other Data Types

When configuring your Data Channel, you may choose: Data Type: Other This type has no strict requirements, but XARF formatting via email is still recommended. Describe the kind of data you’re sending in the What kind of data is this? field of the setup form. This context helps us correctly evaluate and process the submissions.
ℹ️ “Other” data is held in staging and not automatically parsed until reviewed.