Mailbox (from Dropbox) is using Nodemailer to send your emails from Amazon AWS

Wed, Oct 29, 2014

So I started testing Mailbox on my iPhone and my Mac recently. It has a very elegant interface and a nice Snooze feature (basically you can tell Mailbox to put some messages back to your inbox to process at a later time – this is quite similar to a Chrome extension — Boomerang). The Mac version is beta, but the iPhone version has been around for more than a year, so I don’t think the core functions will change any time soon.

One thing I notice about Mailbox is they don’t send email using Gmail SMTP servers. Wait. Something definitely wrong here. The question is Why? The Mailbox app has granted full access to Gmail account, so why don’t they just use Gmail’s SMTP to send mail? Instead, they use Nodemailer on Amazon AWS. What the hell?

Return-Path: <>
Received: from hedwig-51.prd.orcali.com (ec2-54-85-253-165.compute-1.amazonaws.com. [54.85.253.165])
        by mx.google.com with ESMTPSA id u2sm2020155qap.22.2014.10.28.11.54.28
        for <>
        (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
        Tue, 28 Oct 2014 11:54:28 -0700 (PDT)
Date: Tue, 28 Oct 2014 11:54:28 -0700 (PDT)
X-Google-Original-Date: Tue, 28 Oct 2014 18:54:27 GMT
MIME-Version: 1.0
X-Mailer: Nodemailer (0.5.0; +http://www.nodemailer.com/)

So what is the point of promoting domain keys, or DKIM? Why not send email using a legitimate and foolproof? Instead, they send users email from a fake SMTP server hosted somewhere on Amazon AWS. I don’t get their point.

Update: Thanks Sean Beausoleil and Andris Reinman for clearing that up. I would definitely prefer Amazon AWS over my own IP address to be revealed in email headers.