Updated 17 Aug 2026 at 19:53 CEST.
On August 13th, our email service experienced a DDoS (Distributed Denial of Service) attack which affected the Runbox email servers and our customers’ access to their email accounts. The DDoS attack consisted of a massive volume of data traffic to our service designed to overwhelm our servers, and resulted in blocking our customers from accessing our services.
Details and timeline of the DDoS attack
On August 13th at 15:36 CEST, we were alerted internally to connectivity issues with our email services. We posted the first Status update at 15:44 CEST about these issues and we began investigating possible causes.
After our system administrators began investigating, initial evidence suggested a network issue outside our systems causing connectivity problems to a number of services, and we posted another update at 16:02 CEST.
Email access via IMAP, POP, and SMTP connections was available again by 16:40 CEST, while web and incoming email delivery were still affected.
By 17:00 CEST, it was evident that this was a DDoS (Distributed Denial of Service) attack on our servers, which was also affecting other services as a side effect. Our system administrators continued to work to mitigate the attack. We posted another update at 19:06 CEST.
Web services and email delivery started to return to normal, except for an incoming mail queue from outside the Runbox network that had accumulated and that our servers had to process. Our system administrators and connectivity providers continued to work on further mitigations against the attack. The next status update was posted at 20:29 CEST.
By 14 Aug 2026 11:04 CEST, services were back to normal and the incoming mail queue had been cleared.
Domino effect and lingering issues
On August 14th, it was becoming clear that as a direct result of the DDoS attack there were lingering mail delivery delays and MX record validation problems for email hosting domains. We posted a status update about this on August 14th at 16:30 CEST.
The DDoS attack that flooded our servers with traffic had caused our servers to in turn flood external services with DNS lookups, which then caused some of those services to block our lookup requests. This therefore hindered our ability to deliver email to those services and caused delays of some incoming and outgoing email.
Most messages appeared to be delivered normally, but some were affected by this issue and we continued to work to resolve this problem.
The DNS lookup problems also affected our system’s ability to validate new customer domains, which we posted a status update about at 15 Aug 2026 at 09:41 CEST.
Since then the cascading issues with incoming and outgoing email delivery have substantially improved and continue to subside, but any delayed or incorrectly rejected messages are problematic and we are continuing to address this with our system administration team. We updated our service status page again on August 16th at 20:21 CEST.
Update 17 Aug 2026 at 14:32 CEST: As we investigated further, we found that particular DNS servers temporarily blocked our mail servers, which most likely was a defensive reaction to the unusual traffic from our mail servers during and after the DDoS attack. When you send an email, Runbox needs to look up the address of the receiving mail server in a directory of DNS (Domain Name System) servers before the mail can be delivered. After the DDoS attack, Runbox’s system was trying to deliver all the mails in the queue, and sent out a massive wave of requests to other servers. As a result, some receiving servers saw this as suspicious and temporarily refused or blocked the requests.
A workaround to circumvent this problem appears to be working and the outgoing email queue to the affected services is decreasing. Updated our service status page on August 17th at 14:32 CEST.
Update 17 Aug 2026 at 19:53 CEST: The mail queues have now substantially improved, and mail delivery is happening normally. Sending servers at other email services will retry sending messages you have not received if they haven’t already returned the messages to the sender. You may still see messages you expected earlier to arrive over the next few hours.
We will continue to update both status.runbox.com and this post when more details are available.
Lessons Learned
Because the DDoS attack was an urgent problem to resolve, our initial attention was on restoring connectivity for our customers. The initial mail queue looked like a normal backlog as a result of the attack, and it took time to investigate why mail to specific services were failing. It was less obvious that certain servers were blocking mail deliveries from Runbox, and diagnosing it required certain patterns to emerge so that we could rule out other causes first.
This event highlights the importance of downstream monitoring of mail delivery patterns to address cascading issues such as third-party blocking, simultaneous with our mitigation efforts of the attack itself.
Moving forward
We continue to closely monitor our services to make sure that operations remain normal and to resolve any remaining issues. If you continue to experience issues, please don’t hesitate to reach out via support.runbox.com or mail@support.runbox.com.
A reliable email service is critical to our customers, but DDoS attacks can be difficult to mitigate against. Even large companies with virtually unlimited resources can be impacted when criminals seek to exploit critical services through extortion. Runbox has persevered against similar DDoS attacks in the past, and we will never pay criminals who attack our services because this would only fund further attacks against Runbox or other services in the future.
What we can and will do is assess our threat mitigation models and investigate where we can tighten up and implement further protections for our servers. We are looking into several options with our system administrators.
Thank you for your support while we work to mitigate the attack and clean up the residuals. We move forward knowing that your trust in us is paramount, and we continue to work tirelessly to earn it.
—The Runbox Team