vsx.email

What This Is

vsx.email is a DNS server that gives any public IPv4 address an instant subdomain. No signup, no config, no waiting for propagation.

We built this for VaultSandbox — a Docker container that receives email. The container needs a domain with MX records and a TLS certificate. This DNS service provides both without any setup.

How It Works

1. 1
   Your IPv4 address is encoded to base36: 203.0.113.10 → 1mzhr2y
2. 2
   Our DNS server probes your gateway: GET http://{ip}/.well-known/vaultsandbox
3. 3
   DNS queries resolve to your IP: 1mzhr2y.vsx.email → A and MX records

If you're running VaultSandbox, the probe endpoint is handled automatically. No setup required.

If the probe fails, you get NXDOMAIN. No gateway running = no DNS.

Why Sending Spam Won't Work

Before you get ideas: these domains are hardcoded to be useless for sending email.

Every subdomain returns these records:

Gmail, Outlook, Yahoo, and any compliant mail server will reject email claiming to be from *.vsx.email. These domains can receive mail, not send it.

To send spam from here you'd need to:

1. Rent a server (costs money)
2. Keep port 80 open and serving our probe endpoint (effort)
3. Accept that your email goes straight to spam/reject anyway

It's easier to buy a $10 .xyz domain.

Additional protections:

• CAA records: Only Let's Encrypt can issue certificates
• Deep subdomain blocking: Only {base36}.vsx.email resolves — foo.{base36}.vsx.email returns NXDOMAIN
• Private IP blocking: 10.x, 172.16-31.x, 192.168.x, localhost, etc. all fail
• Rate limiting: Response Rate Limiting (RRL) enabled
• No recursion: We only answer for *.vsx.email, nothing else
• ANY query blocking: Returns HINFO per RFC 8482

DNS Records Reference

Root Domain: vsx.email

Gateway Subdomains: {base36}.vsx.email

Only returned if probe succeeds:

Email Security Records

For any valid gateway at {base36}.vsx.email:

Base36 Encoding

IPv4 → 32-bit integer → base36 string.

IP Address      Base36      Domain
───────────────────────────────────────
203.0.113.10    1mzhr2y     1mzhr2y.vsx.email
8.8.8.8         2h4s9s      2h4s9s.vsx.email
1.2.3.4         a2f44       a2f44.vsx.email

Max 7 characters. Lowercase alphanumeric only.
IPv4 only. IPv6 would make subdomains too long.

Check-In API

GET https://api.vsx.email/check-in

Called by gateways at boot time to verify connectivity.

Success (200):

{
  "status": "ready",
  "ip": "203.0.113.10",
  "domain": "1mzhr2y.vsx.email",
  "message": "You are live! DNS is active."
}

Probe Failed (503):

{
  "status": "error",
  "ip": "203.0.113.10",
  "error": "Probe failed. Could not reach your gateway on port 80.",
  "action": "Please ensure port 80 is forwarded to your VaultSandbox container..."
}

Gateway Requirements

To get DNS resolution, your server must:

1. Have a public IPv4 address (no NAT/CGNAT without port forwarding)
2. Respond to GET http://{ip}/.well-known/vaultsandbox with HTTP 200
3. Keep port 80 open (required for probe and Let's Encrypt HTTP-01 challenge)

Blocked IP Ranges

These will never resolve:

Privacy

No analytics. We don't track users or keep long-term logs.

Test It

# Resolve the root domain
dig vsx.email A +short

# Check MX record
dig vsx.email MX +short

# See SPF
dig vsx.email TXT +short

# Test an invalid subdomain (should be NXDOMAIN)
dig invalid-test.vsx.email A

# Test a private IP (returns NXDOMAIN)
# 10.0.0.1 = base36 "2rvxtt"
dig 2rvxtt.vsx.email A

Questions