tmailrPrivacy
What a forwarder should refuse to carry
10 July 2026 · 2 min read · TMailr
A forwarding service is a delivery route into somebody’s real mailbox, and a delivery route that carries anything is a delivery route worth abusing. So some things do not get forwarded, and it is worth being specific about which and why.
Executables are refused
Anything whose extension marks it as a program does not get relayed onward: exe, scr, bat, cmd, com, pif, msi, dll, jar, js, vbs, ps1, hta, lnk, iso, apk, and their relatives. There is no legitimate case where the right way to send somebody a program is through a privacy alias, and there is a very common illegitimate one.
The check is on the name rather than the content, because the name is what a mail client shows and what a person double-clicks. It is case-insensitive, which sounds obvious and is the kind of thing worth a test: SETUP.MSI is the same risk as setup.msi.
Why refuse rather than strip
Removing a part would be friendlier, and it would break the message. A forwarded message keeps the sender’s DKIM signature only if the bytes are untouched, and that signature is the thing making the mail trustworthy at the far end. Strip an attachment and you have destroyed the authentication in order to deliver a message the recipient now cannot verify.
So the message is refused as a whole, and the refusal is recorded in the alias history where the owner can see it. Visible beats silent: knowing something was held back is what lets you go and ask the sender for it another way.
What else does not get forwarded
- Messages that have already been through us, which would otherwise loop between two servers until something gives out.
- Automatic messages and bounces, because a bounce chasing a bounce never terminates.
- Anything larger than the size limit, refused during the SMTP conversation with a permanent code so the sender is told immediately rather than retrying for days.
What is not checked
We do not scan attachment contents for malware, and we do not claim to. Antivirus on a relay is a partial measure at best and pretending otherwise would encourage exactly the wrong assumption. A document from a stranger is a document from a stranger whether it passed through us or not.
What we do is narrower and more honest: refuse the file types whose only purpose is to run, keep the rest byte-for-byte intact so your own client and your own scanner can judge them, and tell you when something was held back.
More on privacy
