Quick answer
Which uses does Ironatoll allow on a dedicated server?
An Ironatoll dedicated server can carry websites, your own VPN, Tor relays with exits among them, Proxmox VE virtual machines, game servers and full Bitcoin or Monero nodes. A DMCA notice changes nothing, since Panamanian law and Panamanian courts are the only ones that apply. Ten uses are banned: spam, phishing, malware and botnets, attacks, scanning, booters, carding and fraud, child sexual abuse material, mining, and serving sanctioned people. Port 25 is shut for outgoing mail, and any breach ends in suspension.
1. Scope
This policy covers every Ironatoll account and dedicated server, every virtual machine running on one, and every person who uses them. It forms part of the Ironatoll terms of service and covers every plan on the pricing page alike. Anything that runs on your server is on you, and so are the machines and logins you give to other people.
2. Which law applies?
Ironatoll is run by DomaineGoat LLC, a company registered in Panama, and answers only to Panamanian law. Each server’s datacenter, for its part, is bound by the law of the country it stands in. Ironatoll does not act on a legal demand founded on another country's law.
3. What may run on a server?
Your server may run anything that section 6 leaves off its list. Some uses Ironatoll names explicitly as fine:
- sites, web apps, APIs and services you host for yourself;
- your own VPN with WireGuard or OpenVPN (see should I use a dedicated server for my own VPN);
- Tor relays of every kind (section 4);
- virtual machines under Proxmox VE (see how do I install Proxmox on a dedicated server);
- game servers (see can I host game servers on a rented dedicated server);
- full Bitcoin or Monero nodes (see can I run a Bitcoin or Monero node on a dedicated server);
- language models on the processor (see can I run an LLM on a dedicated server without a GPU);
- a mail server that hands its outgoing mail to a relay provider on port 465 or 587 (section 7);
- storage, backup targets, and machines for development or testing.
4. Are Tor relays allowed?
Yes. Tor exit relays may run on our servers, and so may middle relays and bridges. Port 25 is shut for outgoing traffic on all servers, so no exit relay can pass SMTP on that port.
Running a Tor exit relay on a dedicated server walks through the setup, and is it legal to run a Tor exit node covers the legal side.
5. What happens to DMCA and foreign copyright notices?
DMCA ignored: no DMCA notice, and no other foreign copyright notice, leads to any action on our side. Panamanian law and the orders of Panamanian courts are the only authority we answer to. A notice under the DMCA, or under any other foreign country's copyright law, brings no takedown and no suspension.
Ignoring copyright notices does not lift the bans of section 6, which hold on every server. What does "DMCA ignored" mean for a dedicated server explains the reasoning, which is about jurisdiction.
6. Which uses are prohibited?
Spam and bulk email, phishing, malware and botnet control, DDoS and other attacks, scanning or brute-forcing systems that belong to others, booter and stresser services, carding and fraud, child sexual abuse material, cryptocurrency mining and any service to sanctioned people or companies are all forbidden.
Below, each of the ten bans is defined. Every ban covers the server, all virtual machines running on it and any service you resell from it.
| Banned use | What falls under it |
|---|---|
| Spam and bulk email | Mass mailings and messages nobody asked for, whatever the port and whatever the mail provider. |
| Phishing | Anything that impersonates a bank, wallet, shop or other service, whether a page, a message or an app, in order to harvest logins, card numbers or recovery phrases. |
| Malware and botnet control | Storing or distributing malicious software, and running command-and-control servers for compromised machines. |
| DDoS and other attacks | Any flood, exploit traffic or other attack aimed at any system from the server or from a machine running on it. |
| Scanning and brute-forcing | Scanning ports or vulnerabilities, or guessing passwords, on systems you do not own. |
| Booter and stresser services | Operating or selling a flood-on-demand service under any label, "stress testing" among them. |
| Carding and fraud | Checking or using stolen card data, fake shops, scam pages, or any other trick for getting money or goods by deception. |
| Child sexual abuse material | Storing, sharing or linking to such material, in whatever form. No exception exists. |
| Cryptocurrency mining | Mining of any coin, with any software, directly on the server or in one of its virtual machines. |
| Serving sanctioned people or companies | Accounts or services for anyone on a sanctions list, person or company, or for anyone in a country or region named in section 8. |
Where three of the rules end:
- Nodes versus mining: a full node verifies a blockchain without mining anything, so Bitcoin and Monero nodes are permitted.
- Scanning your own machines: testing and scanning hardware you own is fine; hardware owned by anyone else is not.
- Normal mail: personal or business mail from your own server is allowed once a relay provider takes it on port 465 or 587. Mass mailing remains banned on any port, through any provider.
7. Why is port 25 closed?
Port 25 (SMTP) is blocked for outgoing traffic on every server as an anti-spam measure, and the block is permanent. Outgoing connections to mail providers on ports 465 and 587 work normally. That is why a mail server at Ironatoll sends its outgoing mail through a relay provider on 465 or 587. How to set it up: can I host a mail server on an offshore dedicated server.
8. Who cannot use Ironatoll?
We turn away people and companies located in Cuba, Iran, North Korea, Syria, Russia, Belarus, China, Yemen or Western Sahara, or in the occupied regions of Ukraine. We match every incoming payment against public sanctions lists of blockchain addresses, and a payment sent from a listed address is never added to a balance. Only people who have turned 18 can open or hold an account.
9. How are abuse reports handled?
Foreign copyright notices, DMCA ones included, are set aside: we act only under Panamanian law or on a Panamanian court order. Spam, phishing, malware, botnet control, attacks and child sexual abuse material are banned, and any one of them gets the server suspended.
Send reports about any Ironatoll IP address to [email protected]. A report gets handled sooner when it contains:
- the Ironatoll IP address concerned;
- when it happened: date and time, preferably UTC, or local time with the zone named;
- the type of abuse, such as spam, phishing, malware, an attack or a scan;
- evidence: logs, complete email headers or the URL at fault.
Copyright complaints get no action from the abuse desk, whether they invoke the DMCA or some other foreign law.
10. What does a suspension mean?
Breaking a rule of section 6 gets the server suspended. The dashboard then shows it as suspended, and support will tell you why if you email them. Days left on a server suspended for a breach are not credited, because the refund policy gives credits in its listed cases and no others.
A server whose paid days have simply run out is a separate case, governed by the terms of service: its disks are held for 7 days and then wiped.
11. How do I appeal a suspension?
Email [email protected]. A person answers support emails within 12 hours, seven days a week, including help with SSH keys, RAID, reinstalls and firewall rules.
- Quote the server's IP address together with its order reference (ORD-…).
- Do not include your account number. Nobody from our team will ever ask for your account number, your root password or your private SSH key, by email or in a chat.
- Describe what went wrong and what you have fixed since: malware removed, an open mail relay closed, a virtual machine shut down.
12. When are records handed over?
Nothing is handed over without an order from a Panamanian court. The full list of records is in the privacy policy. No logs: we keep no connection logs, no traffic logs and no IP addresses of visitors or customers, on the website, the dashboard or the servers.
13. Changes to this policy
This version of the policy is dated 30 October 2026. It may be revised; the date at the top shows which version is in force, and a revision applies to every server from that date.