Inbound email: receive mail on your domain, read it through the API

SMTPfast can now receive mail on your verified sending domains. Use it for customer replies, or for application addresses such as support@ and invoices@, without polling an IMAP inbox. API access uses an SMTPfast key with the inbound scopes, and the email.received event goes through the same webhook system as your delivery events.

What you get

• Receiving per domain. Enable receiving on a verified domain and publish its MX record. SMTPfast then accepts mail for any address on that domain. If your root domain already has a mailbox provider, use a dedicated subdomain such as inbound.yourdomain.com; a subdomain of a verified domain can enable receiving without its own verification step.
• An Inbound page in the dashboard. Search and filter, read the message with a sandboxed HTML preview (remote images stay off until you turn them on), see headers and authentication verdicts, download attachments and the raw .eml. Owners and admins can delete.
• A receiving API. List received mail, fetch a message with its bodies and headers, get 15-minute download links for the raw file and attachments, or delete your team's copy. The endpoints and object shapes follow Resend's receiving API. Keys need inbound:read or inbound:delete; keys created before today get the scopes from the API keys page.
• An email.received webhook. Each delivery emits one event with the message metadata once it is parsed or quarantined. Fetch the message by id when you need the body. Standard, Discord and Slack webhook formats all work.
• MCP tools. Agents connected to the hosted MCP server can list and read received mail, fetch attachment links, and turn receiving on or off for a domain.

How it works

The receiving endpoint stores the raw message and attaches spam, authentication and virus verdicts. A worker routes the message from the SMTP envelope rather than the To header, so Bcc and forwarded deliveries land with the actual recipient and a forged header cannot redirect anything.

Clean messages are parsed within fixed limits: 25 MiB per message, up to 25 attachments of 20 MiB each, one million characters per body part, 200 headers. Attachments are written to storage per team. Before it returns a download link, the API checks that your team owns the message, and the link expires after 15 minutes.

If the virus verdict is anything but PASS, the message is marked quarantined. SMTPfast does not parse it and does not expose its body, headers, raw file or attachments; you see that it arrived and from whom.

Received mail is retained for up to 30 days, then the parsed message, the raw file and the attachments are removed. Owners and admins can delete a team's copy earlier through the API or the Inbound page.

Setting it up

1. Open Inbound in the dashboard, pick a verified domain (or type a subdomain of one) and click Enable receiving. The API equivalent is PATCH /v1/domains/{id} with {"receiving_enabled": true}.
2. Publish the MX record it shows, priority 10. SMTPfast must be the only MX record at the lowest-numbered priority. Another record at 10 may split the traffic, and one below 10 takes it; either case sets the status to failed until you fix it.
3. Once the record resolves, the checker (about once a minute by default) flips the status to active. Send yourself a test message and open the Inbound page.

Inbound email is included on the Starter, Growth and Scale plans. Limits, the API reference and the webhook payload are in the Inbound docs.

What comes next

Tell us what you would build with it: a per-address view, replying from the dashboard, and forwarding rules are the candidates on our list. Write to [email protected] with your use case.