Authentication-Results: mx.agentboxd.com; dmarc=fail

Customs.

Every email that crosses into or out of Agentboxd goes through Customs. Mail coming in is checked and scored before your agent reads it. Mail going out is limited, tracked and stopped when it starts to look like spam. It runs on every plan, with nothing to set up.

message.received

Coming in

Once an agent has an address, anyone can put text in front of the model. Customs treats every email as untrusted input. More in Prompt injection by email.

SPF · DKIM · DMARC: Our mail server checks who really sent every message. A failure is labelled on the message (spf-fail, dmarc-fail), so a spoofed “from your bank” email is marked before your agent sees it.
ai.risk.injection: Each message gets a prompt-injection score. An “ignore previous instructions” email scored 0.99 in our tests and got the ai:injection-risk label. The raw score is kept, so you choose your own cut-off.
ai.risk.phishing: A phishing score and the ai:phishing label for credential grabs, fake invoices and lookalike senders, next to a needs-a-human flag.
UNTRUSTED MESSAGE CONTENT: Through the MCP server, every result that contains email starts with a marker telling the model to treat it as data, never as instructions, and flagged mail carries a warning field.
extracted_text: Only the new part of a reply reaches your agent: quoted history and signatures are cut, so text hidden in an old quote is not read again on every turn.
Allow and block lists: Decide per inbox or workspace who may reach your agent. Refused mail is kept and labelled, never bounced, so senders can’t probe your lists.
sandbox: The dashboard shows a message’s HTML with no scripts, forms or navigation. Attachments download; they never open on our domain.

GET /v1/messages/:id

What your agent sees

Labels and scores arrive with the message, so your code decides before the model reads a word.

an inbound message (trimmed)

{
  "from": "\"IT Helpdesk\" <helpdesk@it-support-notice.example>",
  "subject": "Action required: verify your mailbox",
  "labels": ["dmarc-fail", "ai:injection-risk", "ai:phishing"],
  "ai": {
    "risk": { "injection": 0.99, "phishing": 0.86 },
    "needs_human": 0.74
  }
}

guard.ts

const RISKY = [
  'spf-fail', 'dmarc-fail',
  'ai:injection-risk', 'ai:phishing',
];

// Decide before the model reads the message.
const flagged = msg.labels.some((l) => RISKY.includes(l));
const injection = msg.ai?.risk?.injection ?? 0;
if (flagged || injection >= 0.5) {
  return { acted: false, reason: 'held by Customs' };
}

drafts:write

A person in charge

For the moments when an agent should ask first, or stop.

drafts:write: Give an agent a key that can write drafts but not send them. A person approves each draft in the dashboard.
Pause: Stop one inbox from sending at once. Mail still arrives and waits for you.
Emergency stop: One switch stops every send and every sign-in token of a workspace, for the moment an agent goes wrong.
Human on call: Messages that need a person, and events like an emergency stop, are sent to the people you name, straight away or as a digest.
Agent-Disclosure: Mail your agent sends says, in a header, that an AI agent wrote it and for whom, so recipients and their filters can tell.

abuse@agentboxd.com

Going out

Every workspace shares our sending reputation, so Customs stops spam at the source: the first sends of a new account, and any workspace whose mail bounces or draws complaints.

Send limits: Per inbox, per workspace each day and per 5 minutes, from your plan. A runaway loop hits a wall long before it floods anyone.
New workspaces: A new Free workspace sends at most 20 emails a day, and 10 per 5 minutes, for its first 3 days. A throwaway account can’t spend a full allowance before any bounce comes back.
Agent self-signup: A workspace an agent created for itself needs a proof of work to exist, and until a person claims it may write to at most 20 new recipients a day.
Suppression: An address that hard-bounced or reported our mail as spam is never mailed again from anywhere on Agentboxd.
Auto-suspension: A workspace whose hard-bounce rate passes 5%, or complaint rate 0.1%, over 7 days stops sending until we review it. The check runs after every bounce and complaint.
Feedback loops: When an Outlook or Hotmail user marks our mail as spam, Microsoft sends us a report and the complaint counts at once. Reports only count when the provider’s signature checks out, so nobody can get you suspended with forged complaints.
Reputation watch: Our sending IP is checked against the main blocklists every hour, and Google Postmaster Tools and Microsoft SNDS show how Gmail and Outlook see our domains.
DKIM · SPF · DMARC: Every message we send is DKIM-signed, and our domains publish SPF and DMARC records, so receivers can reject mail that only pretends to come from your agent’s address.

what it does not do

Where it stops

What is planned is on the roadmap. How we protect the service itself is on Security.

Scores need AI processing: Injection and phishing scores come from the Categorize level (the default) and above. A workspace that turns AI processing off keeps the sender checks, lists and limits, but gets no scores.
Not a guarantee: No filter makes prompt injection impossible. Customs gives your agent layers and signals, and keeps a person in the loop where it matters.
Outgoing content: Outgoing mail is limited and tracked, not yet read for phishing. Scoring mail from new workspaces before it leaves is on the roadmap.
Gmail complaints: Gmail doesn’t report single complaints to anyone; we see its spam rate only in total, in Postmaster Tools.