CraneMail EU Has Been Erected - Lifetime Deals Now in Amsterdam

vitobotta · July 2025

@Francisco I do not want to update my ticket again, but I would appreciate an update. I opened a ticket a few days ago because I tried to add a domain with a punycode character and the app gave an error, probably because of the encoding. I need to set up a mailbox with this domain soon to demonstrate a vulnerability in a bug bounty program before someone else does, since it's a critical account takeover bug worth $$$$. Someone who replied to the ticket said you would be looking into it.

Francisco · July 2025

@vitobotta said:
@Francisco I do not want to update my ticket again, but I would appreciate an update. I opened a ticket a few days ago because I tried to add a domain with a punycode character and the app gave an error, probably because of the encoding. I need to set up a mailbox with this domain soon to demonstrate a vulnerability in a bug bounty program before someone else does, since it's a critical account takeover bug worth $$$$. Someone who replied to the ticket said you would be looking into it.

I know your ticket I’m away for the 4th long weekend but let me see if I can poke at it tonight.

Francisco

Astro · July 2025

@vitobotta said:
@Francisco I do not want to update my ticket again, but I would appreciate an update. I opened a ticket a few days ago because I tried to add a domain with a punycode character and the app gave an error, probably because of the encoding. I need to set up a mailbox with this domain soon to demonstrate a vulnerability in a bug bounty program before someone else does, since it's a critical account takeover bug worth $$$$. Someone who replied to the ticket said you would be looking into it.

just use whatever other mail host works with that domain? for the $$$$$$$$$ time sensitive opportunity

vitobotta · July 2025

@Francisco said:

@vitobotta said:
@Francisco I do not want to update my ticket again, but I would appreciate an update. I opened a ticket a few days ago because I tried to add a domain with a punycode character and the app gave an error, probably because of the encoding. I need to set up a mailbox with this domain soon to demonstrate a vulnerability in a bug bounty program before someone else does, since it's a critical account takeover bug worth $$$$. Someone who replied to the ticket said you would be looking into it.

I know your ticket I’m away for the 4th long weekend but let me see if I can poke at it tonight.

Francisco

Sorry, I forgot today is a holiday in the US. I am just a bit anxious about reporting this bug. I want to make it easier for the triager to reproduce, so I need to create a mailbox on this domain I already have. This way, they will not need to register one or set up email themselves. Sorry if I am rushing you.

vitobotta · July 2025

@Astro said:

@vitobotta said:
@Francisco I do not want to update my ticket again, but I would appreciate an update. I opened a ticket a few days ago because I tried to add a domain with a punycode character and the app gave an error, probably because of the encoding. I need to set up a mailbox with this domain soon to demonstrate a vulnerability in a bug bounty program before someone else does, since it's a critical account takeover bug worth $$$$. Someone who replied to the ticket said you would be looking into it.

just use whatever other mail host works with that domain? for the $$$$$$$$$ time sensitive opportunity

I know I could, you're right, but I'd rather not set up a separate email service just for this

Astro · July 2025

@vitobotta said:

@Astro said:

@vitobotta said:
@Francisco I do not want to update my ticket again, but I would appreciate an update. I opened a ticket a few days ago because I tried to add a domain with a punycode character and the app gave an error, probably because of the encoding. I need to set up a mailbox with this domain soon to demonstrate a vulnerability in a bug bounty program before someone else does, since it's a critical account takeover bug worth $$$$. Someone who replied to the ticket said you would be looking into it.

just use whatever other mail host works with that domain? for the $$$$$$$$$ time sensitive opportunity

I know I could, you're right, but I'd rather not set up a separate email service just for this

Is this your ONLY mail service that supports custom domains?

vitobotta · July 2025

@Astro said:

@vitobotta said:

@Astro said:

@vitobotta said:
@Francisco I do not want to update my ticket again, but I would appreciate an update. I opened a ticket a few days ago because I tried to add a domain with a punycode character and the app gave an error, probably because of the encoding. I need to set up a mailbox with this domain soon to demonstrate a vulnerability in a bug bounty program before someone else does, since it's a critical account takeover bug worth $$$$. Someone who replied to the ticket said you would be looking into it.

just use whatever other mail host works with that domain? for the $$$$$$$$$ time sensitive opportunity

I know I could, you're right, but I'd rather not set up a separate email service just for this

Is this your ONLY mail service that supports custom domains?

At the moment I am only using CraneMail, yes

vitobotta · July 2025

@Francisco said:

@vitobotta said:
@Francisco I do not want to update my ticket again, but I would appreciate an update. I opened a ticket a few days ago because I tried to add a domain with a punycode character and the app gave an error, probably because of the encoding. I need to set up a mailbox with this domain soon to demonstrate a vulnerability in a bug bounty program before someone else does, since it's a critical account takeover bug worth $$$$. Someone who replied to the ticket said you would be looking into it.

I know your ticket I’m away for the 4th long weekend but let me see if I can poke at it tonight.

Francisco

Quick update: Cloudflare email routing works with punycode domains, so I’m set for now since I only need this for occasional testing, not for a real mailbox. Still, it’s a good idea to fix the issue anyway.

bonkas · July 2025

Hello, I've paid for the lifetime package in eu in invoice 30379. Would appreciate it if it can be looked on (as I can't seem to still use it yet?), thanks
@Francisco

Francisco · July 2025

@bonkas said:
Hello, I've paid for the lifetime package in eu in invoice 30379. Would appreciate it if it can be looked on (as I can't seem to still use it yet?), thanks
@Francisco

Karen should check it tomorrow worst case

Francisco

rekt · July 2025

@ahnlak said:

@rekt said:

@Francisco said: We're open to feedback on improving the flow

Great that you are open to feedback.

From my previous post:

@rekt said: From attempting to purchase, my understanding is that we cannot use a corporate billing address for purchases unless you also are submitting that order from an IP address within a km radius near that billing address?

Irrespective of selecting PayPal as the payment method (with matching email address, physical address etc.), as it's blocked before even being able to attempt to pay.

It is rather confusing for a business oriented offering and rather trivial for real fraudsters to get around.

Just wanted to check if the above is indeed the intended behaviour and it is essentially set in stone for all cases.

So it sounds like maybe it's not set in stone? My order from today is stuck and I'm essentially wanting to know if gymnastics will be required. The only issue is that I simply don't live personally (ip address) at a corporate billing address. I did not have this issue with OVH (both CA/EU and US), Hetzner or any other provider.

My feedback would be:
Expecting the billing address to match with the user's current IP within a certain km radius does not make sense, especially for a business product. I'd say it's exceedingly common for individuals to not be located at their business billing address, it is a separate entity. There are ~2m companies in Delaware for example and the population is ~1m.

Also, if the address is valid enough to be valid for PayPal, then I would hope that it should be valid enough for Namecrane irrespective of the IP address - especially because bypassing this IP issue would be kindergarten level for any fraudster.

FWIW, it's nowhere near as strict as you make it sound - my IP rarely geolocates in the right country (although still UK), and is usually one or two hundred miles out, but I've never tripped their fraud stuff.

Certainly from the history of BuyVM they haven't exactly struggled for customers (most complaints are about lack of stock) so it doesn't seem likely that they're driving away all legit customers...

Thanks for the input.

It does sound like your IP address location is still relatively close to your billing address. It appears to be based on a km/miles radius, presumably irrespective of country. Though I would assume the process for repeat orders from existing long term customers (which sounds like you) and new customers isn't identical.

I'm not making any claims about their success etc. Only that the specific flag I was hit with (km/miles radius) does not make sense for reasons stated earlier and it would certainly be blocking legitimate customers, while being ineffective deterrent to even entry-level fraudsters. It is also incompatible with industry standard invoicing/billing/accounting practices for corporate entities.

I was simply hoping to find a solution from them here or at least get a straight answer (to not spend any further time trying to resolve this), but appears they are ignoring my posts after attempting to purchase. I only added the extra feedback/opinions after they explicitly stated they are open to feedback to improve the flow. I had assumed that was earnest and not just words, so I took the time to provide feedback under that assumption.

Anyway, it would have been appreciated if broad-stroke restrictions like these were clearly stated upfront on their offering. Like how they do require the individual submitting the order to have an IP address close to the corporate billing address of the purchasing company and appears to be absolutely set in stone. As well as if there are other major restrictions like blanket banning certain normal countries (IP and/or billing).

Non-standard limitations that deviate drastically from industry standards and reasonable expectations should be listed clearly on offerings imo, to save everyone's time - including their own.

bonkas · July 2025

@rekt said:

@ahnlak said:

@rekt said:

@Francisco said: We're open to feedback on improving the flow

Great that you are open to feedback.

From my previous post:

@rekt said: From attempting to purchase, my understanding is that we cannot use a corporate billing address for purchases unless you also are submitting that order from an IP address within a km radius near that billing address?

Irrespective of selecting PayPal as the payment method (with matching email address, physical address etc.), as it's blocked before even being able to attempt to pay.

It is rather confusing for a business oriented offering and rather trivial for real fraudsters to get around.

Just wanted to check if the above is indeed the intended behaviour and it is essentially set in stone for all cases.

So it sounds like maybe it's not set in stone? My order from today is stuck and I'm essentially wanting to know if gymnastics will be required. The only issue is that I simply don't live personally (ip address) at a corporate billing address. I did not have this issue with OVH (both CA/EU and US), Hetzner or any other provider.

My feedback would be:
Expecting the billing address to match with the user's current IP within a certain km radius does not make sense, especially for a business product. I'd say it's exceedingly common for individuals to not be located at their business billing address, it is a separate entity. There are ~2m companies in Delaware for example and the population is ~1m.

Also, if the address is valid enough to be valid for PayPal, then I would hope that it should be valid enough for Namecrane irrespective of the IP address - especially because bypassing this IP issue would be kindergarten level for any fraudster.

FWIW, it's nowhere near as strict as you make it sound - my IP rarely geolocates in the right country (although still UK), and is usually one or two hundred miles out, but I've never tripped their fraud stuff.

Certainly from the history of BuyVM they haven't exactly struggled for customers (most complaints are about lack of stock) so it doesn't seem likely that they're driving away all legit customers...

Thanks for the input.

It does sound like your IP address location is still relatively close to your billing address. It appears to be based on a km/miles radius, presumably irrespective of country. Though I would assume the process for repeat orders from existing long term customers (which sounds like you) and new customers isn't identical.

I'm not making any claims about their success etc. Only that the specific flag I was hit with (km/miles radius) does not make sense for reasons stated earlier and it would certainly be blocking legitimate customers, while being ineffective deterrent to even entry-level fraudsters. It is also incompatible with industry standard invoicing/billing/accounting practices for corporate entities.

I was simply hoping to find a solution from them here or at least get a straight answer (to not spend any further time trying to resolve this), but appears they are ignoring my posts after attempting to purchase. I only added the extra feedback/opinions after they explicitly stated they are open to feedback to improve the flow. I had assumed that was earnest and not just words, so I took the time to provide feedback under that assumption.

Anyway, it would have been appreciated if broad-stroke restrictions like these were clearly stated upfront on their offering. Like how they do require the individual submitting the order to have an IP address close to the corporate billing address of the purchasing company and appears to be absolutely set in stone. As well as if there are other major restrictions like blanket banning certain normal countries (IP and/or billing).

Non-standard limitations that deviate drastically from industry standards and reasonable expectations should be listed clearly on offerings imo, to save everyone's time - including their own.

Are you having trouble making payment? I also had that, but I was suggested to use mobile data and it worked.

Not sure why my internet provider didn't work, but I hope this doesn't trigger flags as I barely use my mobile data later on.

rekt · July 2025

@bonkas said:

@rekt said:

@ahnlak said:

@rekt said:

@Francisco said: We're open to feedback on improving the flow

Great that you are open to feedback.

From my previous post:

@rekt said: From attempting to purchase, my understanding is that we cannot use a corporate billing address for purchases unless you also are submitting that order from an IP address within a km radius near that billing address?

Irrespective of selecting PayPal as the payment method (with matching email address, physical address etc.), as it's blocked before even being able to attempt to pay.

It is rather confusing for a business oriented offering and rather trivial for real fraudsters to get around.

Just wanted to check if the above is indeed the intended behaviour and it is essentially set in stone for all cases.

So it sounds like maybe it's not set in stone? My order from today is stuck and I'm essentially wanting to know if gymnastics will be required. The only issue is that I simply don't live personally (ip address) at a corporate billing address. I did not have this issue with OVH (both CA/EU and US), Hetzner or any other provider.

My feedback would be:
Expecting the billing address to match with the user's current IP within a certain km radius does not make sense, especially for a business product. I'd say it's exceedingly common for individuals to not be located at their business billing address, it is a separate entity. There are ~2m companies in Delaware for example and the population is ~1m.

Also, if the address is valid enough to be valid for PayPal, then I would hope that it should be valid enough for Namecrane irrespective of the IP address - especially because bypassing this IP issue would be kindergarten level for any fraudster.

FWIW, it's nowhere near as strict as you make it sound - my IP rarely geolocates in the right country (although still UK), and is usually one or two hundred miles out, but I've never tripped their fraud stuff.

Certainly from the history of BuyVM they haven't exactly struggled for customers (most complaints are about lack of stock) so it doesn't seem likely that they're driving away all legit customers...

Thanks for the input.

It does sound like your IP address location is still relatively close to your billing address. It appears to be based on a km/miles radius, presumably irrespective of country. Though I would assume the process for repeat orders from existing long term customers (which sounds like you) and new customers isn't identical.

I'm not making any claims about their success etc. Only that the specific flag I was hit with (km/miles radius) does not make sense for reasons stated earlier and it would certainly be blocking legitimate customers, while being ineffective deterrent to even entry-level fraudsters. It is also incompatible with industry standard invoicing/billing/accounting practices for corporate entities.

I was simply hoping to find a solution from them here or at least get a straight answer (to not spend any further time trying to resolve this), but appears they are ignoring my posts after attempting to purchase. I only added the extra feedback/opinions after they explicitly stated they are open to feedback to improve the flow. I had assumed that was earnest and not just words, so I took the time to provide feedback under that assumption.

Anyway, it would have been appreciated if broad-stroke restrictions like these were clearly stated upfront on their offering. Like how they do require the individual submitting the order to have an IP address close to the corporate billing address of the purchasing company and appears to be absolutely set in stone. As well as if there are other major restrictions like blanket banning certain normal countries (IP and/or billing).

Non-standard limitations that deviate drastically from industry standards and reasonable expectations should be listed clearly on offerings imo, to save everyone's time - including their own.

Are you having trouble making payment? I also had that, but I was suggested to use mobile data and it worked.

Not sure why my internet provider didn't work, but I hope this doesn't trigger flags as I barely use my mobile data later on.

Thanks - yeah exactly that, the order was flagged prior to being able to make any attempt at payment. I tried mobile data as well, which unfortunately didn't work for the same reason as the original order. The issue is the expectation for the IP address to be within a certain km/mile radius to the corporate billing address.

netmonk · July 2025

My ip is trash and my account got flagged, I've raised a ticket. Hoping for a resolution.

Francisco · July 2025

@netmonk said:
My ip is trash and my account got flagged, I've raised a ticket. Hoping for a resolution.

@rekt said: Thanks - yeah exactly that, the order was flagged prior to being able to make any attempt at payment.

Both of you can PM me your emails and i'll check. I'll likely just premier you both and call it a day.

Francisco

bonkas · July 2025

@Francisco Thanks for getting back. I got my service, but I'm having trouble on how to set-up the domain's "catch-all" email (its cranemail). Is there any guide you can refer me to?
Googling around seems to say I need to access cPanel, but I can't seem to find where it is.

DanielNU · July 2025

@Francisco

I think there is a lot of potential in CraneMail, especially for resellers. However, the WHMCS module has some serious issues. I raised many of them over the last couple of months with no response.

So I decided to include those issues here as well. I'm sure there are more issues, though.

Some DNS verification strings are missing from the client area.
Limits don’t seem to update when switching packages.
Setting the number of users to “unlimited” (0) still ends up limiting it to just 1.
Clients can’t add extra users/email accounts directly from WHMCS.
The sections the module adds to the client area show up only in English.
It would be nice if the default language for the email client could be set in WHMCS.
The UI looks dated, as if it's from the 90s.

If others have more suggestions, let me know!

mp11 · July 2025

@DanielNU said:
@Francisco

I think there is a lot of potential in CraneMail, especially for resellers. However, the WHMCS module has some serious issues. I raised many of them over the last couple of months with no response.

So I decided to include those issues here as well. I'm sure there are more issues, though.

Some DNS verification strings are missing from the client area.

Limits don’t seem to update when switching packages.

Setting the number of users to “unlimited” (0) still ends up limiting it to just 1.

Clients can’t add extra users/email accounts directly from WHMCS.

The sections the module adds to the client area show up only in English.

It would be nice if the default language for the email client could be set in WHMCS.

The UI looks dated, as if it's from the 90s.

If others have more suggestions, let me know!

would be more useful if you open up issues on the referring Github repositories, so the things get solved their way.

FastLayer · July 2025

Congratulations!

MeAtExampleDotCom · July 2025

@NameCrane said:

Does the service allow mail submitted from an external application server?

Strictly transactional (login verification mostly) messages to registered users, low volume, no marketing, nor messages of any kind to those not explicitly requesting them, single domain, sending host(s) correctly identified in SPF records, incoming mail handled elsewhere. May never get used, looking for a backup service to have on standby in case the current arrangement is down or dies completely.

Francisco · July 2025

@MeAtExampleDotCom said: Does the service allow mail submitted from an external application server?

Strictly transactional (login verification mostly) messages to registered users, low volume, no marketing, nor messages of any kind to those not explicitly requesting them, single domain, sending host(s) correctly identified in SPF records, incoming mail handled elsewhere. May never get used, looking for a backup service to have on standby in case the current arrangement is down or dies completely.

That's fine.

Francisco

@mp11 said: @DanielNU said:

@Francisco

I think there is a lot of potential in CraneMail, especially for resellers. However, the WHMCS module has some serious issues. I raised many of them over the last couple of months with no response.

So I decided to include those issues here as well. I'm sure there are more issues, though.

Some DNS verification strings are missing from the client area.
Limits don’t seem to update when switching packages.
Setting the number of users to “unlimited” (0) still ends up limiting it to just 1.
Clients can’t add extra users/email accounts directly from WHMCS.
The sections the module adds to the client area show up only in English.
It would be nice if the default language for the email client could be set in WHMCS.
The UI looks dated, as if it's from the 90s.
If others have more suggestions, let me know!

And...

would be more useful if you open up issues on the referring Github repositories, so the > things get solved their way.

Only for the bugs, the others are features, but lets go down them.

1) Shouldn't be. Send me a screenshot of it and I can look, but it should pull just fine on the WHMCS module.
2) I'll test on my side, but it worked on my WHMCS. Could be I borked something in one of the quick patches we did.
3) Maybe related to #2. This sounds like an issue with how I treat 0 and 'false'. I'll have to swap things to === I guess. Will test.
4) This was never planned in the module. See below.
5) We could allow you to mark it on a per product basis I guess?
6) It's using Bootstrap 4, whatever the WHMCS default is. It should render fine, and looks plenty fine in Lagom.

The initial build of the module was to just help people handle billing/suspending/provisioning of the service. My original thinking is that our resellers would likely be MSP's or similar that do value-adding for support. We didn't plan to add full self-serve to the module.

We could add it, it's just a lot of API proxying and UX work.

I'm the primary NameCrane dev and right now shared/resellers are getting my immediate attention, then some domains, and then cranemail if something breaks. There's an increasing demand to address 2FA + Calendar/Contacts with Activesync so I'll most likely need to knock that out soon.

Francisco

DanielNU · July 2025

@Francisco said: Only for the bugs, the others are features, but lets go down them.

The initial build of the module was to just help people handle billing/suspending/provisioning of the service. My original thinking is that our resellers would likely be MSP's or similar that do value-adding for support. We didn't plan to add full self-serve to the module.

We could add it, it's just a lot of API proxying and UX work.

@Francisco

I understand the context now. We will try to contribute to GitHub later on for new features.

Bugs:

Specifically, the Domain Verification and DMARC strings are missing from the WHMCS client area.
Setting the number of users to “unlimited” (0) still ends up limiting it to just 1, ONLY at service creation via WHMCS. I have to switch packages to get infinite users, as is defined by default in all our packages.

And this does work, sorry for the confusion:
Limits don’t seem to update when switching packages.

As for the UI looking old, I was talking about the email client itself: https://eu1.workspace.org/interface/root

Despite all of this, I'm pumped about this service. Especially about the desktop client!

COLBYLICIOUS · July 2025

@DanielNU said:

@Francisco said: Only for the bugs, the others are features, but lets go down them.

The initial build of the module was to just help people handle billing/suspending/provisioning of the service. My original thinking is that our resellers would likely be MSP's or similar that do value-adding for support. We didn't plan to add full self-serve to the module.

We could add it, it's just a lot of API proxying and UX work.

@Francisco

I understand the context now. We will try to contribute to GitHub later on.
In the meantime, I will submit all my bug reports privately.

Dear @DanielNU,

Welcome to LowEndTalk Support. Please open an ticket in NameCrane client portal for these kind of informations/problems.

Reguards,
LowEndTalk Support

job0121 · July 2025

@Francisco

It would be very useful to have a receive only without ability to delete any email from the mailbox. I don't think I'm the one here wanting this.

LowerValue · July 2025

Mr. @NameCrane i got a small Crane for you (it works ! you can pick up things with it and it's new),
may i exchange it for a one year cheapest email service in EU location ?

eb1995 · July 2025

.> @LowerValue said:

Mr. @NameCrane i got a small Crane for you (it works ! you can pick up things with it and it's new),
may i exchange it for a one year cheapest email service in EU location ?

That reminds me of the aliens from Toy Story lol

Francisco · July 2025

@LowerValue said: Mr. @NameCrane i got a small Crane for you (it works ! you can pick up things with it and it's new),

may i exchange it for a one year cheapest email service in EU location ?

>

Tempting, but i'm good

I'll be working on EAS w/ 2FA, Calendar, & Contacts, support sometime this week.

Francisco

deqi · July 2025

@Francisco said:
I'll be working on EAS w/ 2FA, Calendar, & Contacts, support sometime this week.

Francisco

Litterally cant wait for this to be working. Thats the only downside atm

Francisco · July 2025

@deqi said: Litterally cant wait for this to be working. Thats the only downside atm

I'll try to work on it some more tonight. I think it'll be pretty quick to merge since I can just reuse code from the Cranemail portal.

Francisco

deqi · July 2025

@Francisco said:

@deqi said: Litterally cant wait for this to be working. Thats the only downside atm

I'll try to work on it some more tonight. I think it'll be pretty quick to merge since I can just reuse code from the Cranemail portal.

Francisco

Ooooh you're getting me excited

Howdy, Stranger!

Categories

In this Discussion

CraneMail EU Has Been Erected - Lifetime Deals Now in Amsterdam

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

CraneMail EU Has Been Erected - Lifetime Deals Now in Amsterdam

Comments