Open source · Any MTA

BetterProxy

A local SMTP proxy that puts BetterPhish phishing intelligence in front of any mail server — and feeds every message it sees back into the phishing corpus.

View on GitHub API Docs

Enforce the feed — and grow it

BetterProxy consults BetterPhish (through the BetterSpam verdict API) on every message and acts on the result inline: a phishing hit can be quarantined or rejected before it reaches a user. In the same pass it submits the message to the BetterPhish feed, so every deployment makes the next verdict sharper. It is the on-prem counterpart to the community submission and Amavisd plugin ingestion paths.

Quick start

export BETTERPROXY_CLOUD_TOKEN=sk_your_api_key betterproxy proxy \ --upstream=mail-internal:25 \ --script=examples/betterproxy-cloud.star \ --cloud-check-url=https://betterspam.com/api/v1/mail/check \ --cloud-submit-url=https://www.betterphish.io/api/v1/submit/email \ --cloud-privacy=full

What it does

Inline verdicts

CLEAN / SPAM / PHISH / BOTH on every message, stamped into standard headers your pipeline can read.

Feeds the corpus

Best-effort async submission to /api/v1/submit/email — your mail flow strengthens the feed.

Fails open

Cloud outage never blocks mail; BetterProxy accepts and falls back to local SPF/DKIM/DMARC + ML.

Privacy modes

Send the full message, headers only, or hash-only. SSRF-hardened, redirect-refusing client.

DKIM-safe

Headers are added above the body; the body is never rewritten, so pass-through signatures survive.

Starlark policy

271 mail-aware builtins. Ship the bundled cloud policy or tune thresholds for your org.

Get BetterProxy