What shipped

If your DNS is on Cloudflare, the Link domain tab now has a "Connect with Cloudflare" button for a pending link domain. You approve the change at Cloudflare, and it adds the CNAME record for you. You can also get the link from POST /v1/link-domains/:id/domain-connect. The manual CNAME record still works with every provider.

Send "track_clicks": false with an API or batch email to send its links untracked, and "track_opens": false to leave out the open pixel; over SMTP, the X-SMTPfast-Track-Clicks and X-SMTPfast-Track-Opens headers do the same. Add data-smtpfast-track="off" to one <a> tag to keep just that link out of the click tracker, for example a password reset link with a token. A new setting can also leave all email labelled transactional untracked.

On paid plans, add a link domain such as links.example.com under a verified sending domain, publish one CNAME record, and the open pixel, tracked links and unsubscribe links in your email use your own hostname instead of smtpfa.st. SMTPfast issues the certificate and checks the status for you, and shows each DNS record as verified, or no longer needed, once the link domain is active. Set it up on the domain page or with the new /v1/link-domains endpoints.

Choose "Spread over 2, 4, 8, 12 or 24 hours" when you send or schedule a broadcast (or pass send_over_minutes, up to 72 hours, in the API and MCP tools) and the recipients go out evenly over that window instead of all at once, so you no longer have to split an audience by hand on a new sending domain. Each hour counts toward a new account's hourly limit only for what lands in it, the broadcast page shows how many have gone out, and canceling stops the rest.

The OpenAPI document now describes every field GET /v1/emails/:id returns, the { id } POST /v1/emails returns, both forms of POST /v1/contacts, and the paging and count fields of the contact, suppression and broadcast lists. Docs examples that showed fields the API does not send, or that were not valid JSON, are corrected. Every docs example is now tested against the OpenAPI document, and so are the real responses of the main endpoints.

A contact marked unsubscribed in the dashboard or with the API was already left out of broadcasts, but marketing email sent through the API or SMTP still reached it. It is now held back there too. Transactional email still goes, and a reply to the sender of a received email (from an inbox or the API, with no added recipients) now counts as transactional, so a newsletter opt-out never blocks a support reply.

Label password resets, receipts and other transactional mail with "category": "transactional" (or the X-SMTPfast-Category header over SMTP) so a recipient's marketing opt-out does not block them; transactional email carries no List-Unsubscribe header. Unlabelled mail is treated as marketing, as before: it keeps the unsubscribe header and skips everyone who unsubscribed. Unsubscribes recorded before today keep blocking every email.

Contacts, segment contacts, suppressions, broadcasts, pending signups and emails now break timestamp ties by id, so rows created in the same instant (a bulk import or a batch send) no longer show up on two pages while others are missed. The deliverability check on an email no longer counts SMTPfast's own unsubscribe and tracking links as off-domain links, and the broadcasts docs now say how fast a broadcast goes out.

Hardening of how anonymous requests are rate limited, including the mail tester.

Get a one-time address at /tools/mail-tester, send it the email you want to check, and get a score out of 10 with a fix for each problem. It checks SPF, DKIM and DMARC with alignment, reverse DNS for the sending IP, spam phrases, one-click unsubscribe, links, image alt text, HTML size against Gmail's clipping limit and client compatibility. No signup needed; reports are deleted after 24 hours.

GET /v1/emails/:id now returns the tags given at send time; they were stored but left out of the response. MCP clients that sign in with OAuth now get contact write by default, so the contact and segment tools work without asking for extra scopes. The docs now show the real webhook payload, which contact changes fire which events, the contacts list paging, and where each placeholder works.

GET /v1/domains, /v1/webhooks and /v1/api-keys now return { object: "list", has_more, data } like every other list, and domain list items use snake_case names such as dkim_status and verified_at. If you read these lists yourself, read data. The Terraform provider reads the new shape from v0.5.0, and the smtpfast CLI already did. The contact and segment plan limits now answer 402, like the domain and webhook limits, so clients no longer retry them.

A request body that is not valid JSON, or a limit such as 2.5, now gets a 400 that says what is wrong on every endpoint, where some answered 500. Every endpoint now answers CORS preflight requests and lets browsers read the rate-limit headers, and limits that clear with time send Retry-After.

The SMTP relay at smtp.smtpfa.st now accepts attachments and inline images (parts with a Content-ID), with the same limits as the API: up to 10 files, 10 MB each, and up to 10 MB per message over SMTP. Before, a message with an attachment was refused.

The OpenAPI spec at /api/v1/openapi.json now describes every success response, marks nullable fields the OpenAPI 3.1 way (type: ["string", "null"]), and corrects fields that did not match what the API returns, such as the canceled email status. Each operation also has x-sdk-group and x-sdk-method names, which code generators can use.

We no longer send to example.com, example.net, example.org, or anything under .test, .example, .invalid or .localhost. Mail to these test domains only bounces and raises your bounce rate, so the API now answers 400 straight away, broadcasts skip them as invalid, and form emails are not sent. For test sends, use an address at simulator.amazonses.com, such as [email protected].

A reply or forward you are writing in an inbox thread now asks before it is thrown away: when you close the thread, mark it unread, archive or delete it, start another reply, cancel, or switch mailboxes. Closing the tab warns too. An empty reply still closes straight away.

POST /v1/forms now sets the confirmation sender and the welcome email in the same call and returns them, and form requests accept snake_case keys like the responses (camelCase still works). New GET /v1/inboxes/{inbox_id}/labels/{label_id} and GET /v1/team/invites/{id} read one label or invitation, and GET /v1/me now returns the user_id of the key's creator.

New mail now appears on the Inbound page on its own, at the top of the list or behind a small "new messages" button, so nothing moves while you read. The message list and inbox threads also get keyboard shortcuts (press ? to see them), one date format everywhere, clickable links in plain-text emails, and labelled buttons in the reader.

Security hardening. No customer action needed.

POST /v1/emails/batch now takes an Idempotency-Key header: a retry with the same key and body within 24 hours returns the first answer instead of sending the batch again. A batch is now accepted whole or not at all, so an error never leaves part of it sent. The response also includes data, the shape Resend returns, next to the existing fields.

Security and reliability hardening. No customer action needed.

List, read and update responses for API keys and webhooks now include the snake_case fields the API reference uses, such as created_at and last_used_at. The older camelCase fields stay, so existing code keeps working. The reference now also documents a webhook's format and signing secret.

Write an email once with variables, publish it, and send it by id or alias with a template object on POST /v1/emails. Edits stay in a draft until you publish, so a live template never changes by accident. The Templates API matches Resend's, the dashboard has an editor with a live desktop, mobile and dark-mode preview, ten starter templates copy in one click, and a broadcast can start from any template.

Turn an address on your own domain into an inbox: received mail and your replies are grouped into threads, with folders, labels and drafts, in the dashboard and through an API that matches Resend's Inboxes API. Drafts are the review step for AI agents: an agent with a key that cannot send writes them, and a person reads, edits and sends them from the Inbound page.

Emails sent only to the SES mailbox simulator (addresses at simulator.amazonses.com) no longer count in the dashboard metrics or the analytics API. They are always tests, and a bounce test could make a quiet account's bounce rate look alarming. They still appear in your email list and logs.

GET /v1/usage returns emails sent today and this month against your limit, prepaid credits, and contacts, segments, broadcasts and domains against their limits, so you can check before a large send or an import. It has the same shape as Resend's usage endpoint, so the Resend SDKs' usage call works too. Any API key can call it.

When a broadcast is canceled or paused, the emails that had not gone out yet are now marked Canceled instead of Failed, including ones from earlier broadcasts. Failed is left for real send errors, and the Emails page has a Canceled filter.

Emails scheduled for later, including scheduled broadcasts, showed up as sent the day they were scheduled and pulled the delivery rate down. The dashboard and the Analytics API now count an email as sent when it actually goes out, work out rates against sent emails that have a delivery report, and list scheduled and queued emails separately. Emails still waiting for a report are shown as awaiting report, and a complained email counts as delivered in the delivery rate.

A broadcast's page now shows a preview of the email itself. Open it to see the message as recipients get it, at desktop or mobile width, along with the plain text version. The builder's live preview also shows unsubscribe links in Markdown correctly now.

A signup form's welcome email can now carry {{unsubscribe_url}} and get a real per-recipient link. It previously rendered as an empty link. The one-click unsubscribe header was always there and is unchanged.

Updating a webhook now works with PATCH as well as PUT. Both apply a partial update, leaving out any field you omit. Code written against Resend, which uses PATCH here, no longer needs changing.

You can now declare the custom fields your contacts use, with a type and a default. The default fills in wherever a contact has no value, so you set it once instead of writing {{company|Acme}} in every template and forgetting it in one. Declaring is optional and undeclared properties keep working exactly as before.

Converting a markdown broadcast to plain text removed underscores before merge tags were filled in, so any tag containing one, including the unsubscribe link, rendered empty in the text/plain alternative. The HTML part was unaffected. Tags now survive the conversion.

POST /v1/broadcasts/{id}/duplicate copies a broadcast into a new draft. The content, sender and targeting carry over; the schedule, recipients and send history do not. Pass a name for the copy, or get the original's with (copy) appended.

Running the AI signup assessment from the admin no longer means waiting several seconds for a paragraph. It returns the score straight away, with a breakdown of how confident it is across the risk levels, and the written reasoning is a second click when you want it.

Three parts of the API had no documentation: the suppression list, the analytics figures behind the dashboard, and GET /v1/me for checking what a key can do. All three now have pages, and the docs sidebar separates endpoint reference from guides so they are findable.

Confirming a broadcast now checks the links in it and points out ones that go nowhere: an empty destination, a "#", a merge tag that was never replaced, an example.com address, or a relative path that no mail client can resolve. It is advice rather than a gate, so you can still send.

GET /v1/broadcasts/{id}/clicked-links returns every link clicked in a broadcast, with total clicks and the number of distinct recipients who clicked each one. The dashboard has shown this for a while; now you can pull the same numbers into your own reporting.

GET /v1/webhooks/{id} returns one webhook endpoint. You could already list, create, update and delete them, so this closes the gap where a webhook could be changed but not read back. Deleting a webhook, reading a single delivery and retrying one are now documented in the API reference too.

The Inbound page now has a rail with the addresses that received mail and their unread counts, messages you have not opened are marked, and each message has a Reply button. Replies go out through your normal sending pipeline, threaded so Gmail and Outlook keep the conversation together, and appear under the message. Mail received on a receive-only subdomain is answered from the verified parent domain with Reply-To pointing back at the mailbox. The API has the same through POST /v1/emails/receiving/{id}/reply.

Receiving domains hosted on Cloudflare get an "Add on Cloudflare" button on the Inbound page. It opens Cloudflare's approval screen with the MX record filled in through Domain Connect; approve once and the record is published, no copying. Other DNS providers keep the copy-and-paste record.

Contacts on disposable-mailbox domains (mailinator, yopmail and about 8,700 others) are now flagged when they are created, imported or submitted through a form. The Contacts page shows a badge and a count, has a Disposable mailboxes filter, and the API returns disposable on every contact with a disposable=true|false filter on the list and export endpoints. Existing contacts are classified in the background.

Amazon SES keeps its own account-level suppression list and used to keep bouncing an address after you had removed it from yours. Removing a hard-bounce or complaint suppression now clears the address at SES as well, sends refused by that list are labelled as such in the email detail, and a daily check reports addresses SES suppressed that no team has on record.

The hosted MCP server now speaks OAuth: add https://smtpfa.st/api/mcp in Claude, Cursor or any MCP client that supports it, click Connect, pick the team and approve the scopes, done. The app gets a token that expires after 8 hours and renews itself for up to 30 days; it shows up under API keys as a connected app, where you can disconnect it. Pasted API keys keep working.

Four tools shaped like the questions people ask an agent: explain_email (what happened to this email and what to do), deliverability_report (one domain over the last days: rates, bounce reasons, DNS health), find_problem_recipients (who to stop sending to, with suppression state) and check_before_send (sender domain, display name, spam patterns, client compatibility and links in one list). They compose the existing endpoints (each tool call is a few API calls against your key's own limits) and need the same scopes those endpoints do.

If your domain was added by someone else (an old account, a former contractor) and never verified, you no longer need support to get it. Publish one TXT record to prove you control the DNS and claim it from the Add Domain dialog or POST /v1/domains/claim. The previous holder is notified. Verified domains are not affected.

Each webhook now has a Deliveries view: every event we sent, with status code, response time, the response body and the error when it failed. Failed deliveries retry on their own (1s, 30s, 5min, 30min) and you can retry any entry by hand from the dashboard or the API. Retries survive deploys; they used to be lost when the app restarted.

Pull the event log behind the Logs page over the API: every queued, sent, delivered, opened, clicked, bounced, complained or failed event, newest first, filtered by type, time window, recipient, domain, tag or email. Needs the new logs:read scope on the key.

An email sent with html only now goes out with a generated text/plain alternative, which text-only clients and spam filters expect.

Give an attachment a content_id and reference it from the HTML as cid:..., and it is delivered inline instead of as a download.

POST /v1/emails/{id}/share, or the Share button on an email, returns a public link to the rendered message that expires after 7 days (up to 30).

Select rows to export them as CSV; on Contacts also unsubscribe or delete the selection. The contacts API accepts a list of ids for deletion.

Paste an HTML email and see which features break in Gmail, Apple Mail, Outlook, Yahoo and Samsung Mail, with a fix for each.

Receive mail on any address of a verified domain. Turn receiving on per domain, publish one MX record, get notified through the email.received webhook, and read the message and its attachments in the new Inbound page or through the Resend-compatible receiving API. Messages are kept for 30 days, scanned, and stored with their attachments. Paid plans.

AI agents connected to the hosted MCP server can list and read received mail, fetch attachment links, and turn receiving on or off for a domain.

Cancel now works for queued and in-flight campaigns, not only scheduled ones. What the provider already accepted stays sent; the rest is stopped and the unused part of your quota or credits comes back.

A campaign whose complaint or bounce rate crosses the guard thresholds is paused mid-send. Unsent recipients are canceled, the sender is notified, and unused quota or credits are refunded.

Pick scopes when creating a key and edit a key's name and scopes later. The key list shows what each key can do at a glance.

Unsubscribe links in already-sent mail keep working after the sender's account is deleted and its team resources move to another member.

Account security and reliability hardening. No customer action needed.

Requests for sending access receive an automated risk assessment before a person makes the final decision.

Registration is protected by Cloudflare Turnstile.

Strip EXIF and other metadata from images in the browser, with detection of AI-provenance markers.

The hosted MCP server speaks the 2026-07-28 protocol revision alongside the legacy one, so newer clients get typed results and cache hints.

A rejected access request now gets a useful default explanation when no custom reason was written.

A retryable provider failure no longer leaves an email stuck in the sending state, and a concurrent broadcast cleanup can no longer refund credits twice.

Large broadcasts are prepared in the background with a progress banner on the broadcast page, and the dashboard stays responsive as audiences grow.

Limits raised for an account by support are now reflected everywhere the dashboard shows quota.

CSV import shows progress, handles files with a byte-order mark, no longer stops at 500 contacts, and a type-to-confirm Delete All clears an audience.

The privacy policy now describes the email and contact data the service processes.

Unique link clicks are counted per recipient instead of per click event.

Each signup form can set the sender used for its double opt-in confirmation email.

Broadcast bodies can include images, and the compose page is a single surface. A scheduled broadcast no longer spends an hourly send slot at the moment it is scheduled.

Sends whose display name impersonates another brand are caught, and a MAIL FROM bug that could block all sends for a domain was fixed.

Outdated pricing figures and unsupported deliverability claims were removed from the public site.

Dashboard-created API keys regained Forms API access, quota warnings retry after a delivery error, and confirmation emails carry a plain-text version.

The RFC 5322 Message-ID of a newly sent email is available as message_id in the email detail API, so you can match replies and threads.

Security and account-isolation hardening. No customer action needed.

The free DMARC checker understands the DMARCbis (RFC 9989) record syntax.

Email validator, BIMI checker and subject line tester join the tools hub.

A full-width compose page with labeled rows, tighter email template padding, and a fix for a subject that could go out empty.

The welcome email editor shows a side-by-side preview as you type, and forms keep unsaved changes visible with a save bar.

Settings > Notifications has a toggle for the occasional product newsletter, and new accounts get a proper welcome email.

Unsubscribe links and other tracked URLs with more than one query parameter were double-encoded and broke. Fixed.

Domains, webhooks, API keys and analytics endpoints rejected API keys after the teams rollout. Fixed, with stricter key-to-team matching.

Manage domains, API keys and webhooks as code with the official Terraform provider.

A per-link board with sortable totals and unique clicks, and a detail view per link.

Invite members, switch between teams, and share domains, API keys, contacts, forms, webhooks and broadcasts. Roles, seats, an audit log, ownership transfer and notification emails included. Team size follows your plan.

The email detail panel in Logs is readable without scrolling through the list, with a single scroll and equal heights.

A new visual language across the landing pages and the dashboard, plus a dedicated Tracking tab in settings. Open and click tracking toggles work again.

Contact history links to each email's detail with bounce reasons, and pending double opt-in confirmations gained search and bulk approval.

Pick a delivery format per webhook and get readable messages in Discord or Slack. Webhooks can be edited in place, and open and click events fire per event with a first_open / first_click flag.

Engagement overview per contact, manual unsubscribe, and links from a contact to its email history.

Upgrade from inside the dashboard, see the hourly limit and how close you are to it, and export contacts on the Starter plan.

Support answers arrive in the in-app widget and by email.

Give an AI agent the ability to send email, check delivery, and manage domains through the hosted MCP server at /api/mcp, authenticated with an API key.

A domain can send once DKIM and the sending-domain verification complete. SPF and DMARC stay recommended but no longer block sending.

Webhook and email-delivery hardening. No customer action needed.

Webhook event names and payload shapes follow Resend's. Swap in SMTPfast signature verification when you migrate a handler.

Deleting a domain removes it cleanly, and a DNS record that disappears now revokes a stale verification instead of leaving it green.

Approve a pending signup form confirmation by hand, and see 7-day and 30-day growth on the contacts tiles.

Links in outbound mail are checked against Google Safe Browsing before a send goes out.

A polished unsubscribe landing page with one-click resubscribe, the {{unsubscribe_url}} placeholder in any body, and a redirect after unsubscribing.

Improved safeguards for unusual sending spikes help protect delivery reputation for everyone on the platform.

Buy prepaid credits that are used once your monthly plan allowance runs out.

Expanded comparison pages, and an MX checker, spam-content checker and markdown email preview in the free tools hub.

Unsubscribes show in the email logs with a filter, and an email.unsubscribed webhook event fires.

Bare URLs in a broadcast body become links, and the preview renders the same as the sent email.

Each signup form can send its own markdown welcome email after confirmation.

Domains on Cloudflare can publish all their records through Domain Connect in one click.

Invited users verify their email before activation, and the request flow was fixed.

Write a campaign in markdown, pick an audience or segment, schedule or send, and follow delivery per recipient.

Bounces, complaints and unsubscribes are kept on a suppression list you can view and manage; suppressed recipients are skipped automatically.

An email warns you when you reach 80% of the monthly allowance. Open and click rates were added to metrics.

The domains page is a routed overview matching the email detail layout, with clearer DNS warnings. Free webmail domains cannot be added as sending domains.

A real-time stream of your email events in the dashboard.

DNS records are grouped by purpose with TTL and priority, and verified records get an inline check mark.

An audit of your domain setup with actionable findings, and per-email deliverability insights on the event timeline.

An audience you can import, export, paginate and subscribe or unsubscribe inline.

Hosted and embeddable forms with double opt-in that feed your contacts.

Send through SMTP with your API key as the password, with tracking and domain ownership enforced like the API. Settings has an SMTP page with the details.

A public status page with incident management, an in-app support widget, and a per-email detail page with the full event timeline.

Send up to 100 emails in one request, attach files, and retry safely with idempotency keys. Scheduling, open and click tracking, and custom MAIL FROM landed with the launch readiness work.

Access is by request while sending reputation is established.

The first free tools for checking a domain's email setup, no account needed.

Four plans with yearly billing, and multi-page docs with sidebar navigation.

Switch from Resend by changing the base URL and key. The full API is described by an OpenAPI 3.1 document.

A step-by-step onboarding flow, an email log per account, and a domain detail page.

Name and email can be changed in settings.

Email sending API, API keys, domain verification with DKIM, SPF and DMARC records, and the dashboard.