Inbound Email

Setup

1. Inbound is available on paid plans. The domain must be verified for sending, or be a subdomain of a domain that is verified in the same team.
2. Turn on receiving for the domain, in the dashboard or with PATCH /v1/domains/:id (below). Most teams use a dedicated subdomain such as inbound.yourdomain.com so the root domain keeps its existing mailbox provider.
3. Add the MX record returned by the API at your DNS provider, priority 10, pointing at the SMTPfast receiving endpoint. On Cloudflare-hosted zones the Inbound page offers "Add on Cloudflare", which publishes the record through Domain Connect after one approval on Cloudflare's side. Our record must be the only one at the lowest priority; a competing MX at the same or a lower priority gets a share of the mail and the domain shows as failed.
4. The status flips to active within a minute of the record resolving. Every address at the domain then receives.

curl -X PATCH https://smtpfa.st/api/v1/domains/dom_xyz789 \
  -H "Authorization: Bearer $SMTPFAST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"receiving_enabled": true}'

The email.received webhook

Subscribe a webhook to email.received and you get one event per delivery (one per recipient address the message was received for), as soon as the message is parsed or quarantined. The payload is the list item shape above (metadata, no body): fetch the email by id for the content. Delivery, signing and retries work like every other event, see Webhooks.

{
  "type": "email.received",
  "timestamp": "2026-09-02T10:00:03.000Z",
  "data": {
    "object": "email",
    "id": "rcv_01j9x2m8k4",
    "from": "Ada Lovelace <[email protected]>",
    "to": ["[email protected]"],
    "received_for": ["[email protected]"],
    "subject": "Order #4821",
    "created_at": "2026-09-02T10:00:00.000Z",
    "attachments": [{ "id": "att_7f3a9c1b2d", "filename": "invoice.pdf", "content_type": "application/pdf", "size": 48213 }],
    "status": "delivered",
    "domain_id": "dom_xyz789"
  }
}

Replying from the mailbox

The Inbound page lists every receiving address with its unread count, and each message has a Reply button. A reply goes out through your normal sending pipeline (it counts as one email, obeys the suppression list and your plan), carries In-Reply-To and References so the recipient's mail client keeps the thread together, and is shown under the received message afterwards. The From address is the receiving address itself when its domain is verified for sending, or when it is a receiving subdomain of a domain you verified: such a subdomain sends on its parent's verification and is signed with the parent's DKIM key, which DMARC accepts. You can also pick a verified parent domain, with Reply-To pointing back at the mailbox so the next message lands there.

{ "text": "Thanks, the replacement ships today." }

{ "id": "em_01j9x5r2k8" }

Limits and retention

• Messages up to 25 MiB. Up to 25 attachments of 20 MiB each; larger parts are dropped and noted on the message.
• Bodies are kept up to one million characters per part. Headers are capped at 200 entries.
• Everything is retained for up to 30 days, then removed: the parsed message, the raw file and the attachments. Delete earlier through the API when you are done with a message; the shared raw file goes once no team references it.
• Every message is scanned. A virus verdict other than PASS quarantines it: the metadata is kept so you know it arrived, and the content is never parsed or exposed.
• Routing follows the SMTP envelope, not the To header, so Bcc and forwarded mail land in the right place and a spoofed To header cannot redirect anything.

Resend compatibility

Paths, pagination, the received email object and the attachment object match Resend's receiving API. SMTPfast adds a few fields (status, verdicts, envelope_from, envelope_to, domain_id, size) and never removes one.

Triage: filters and read state

GET /v1/emails/receiving keeps Resend's shape and adds filters and an unread_count. The read state is the same one the dashboard inbox shows.

{
  "object": "list",
  "has_more": false,
  "data": [ { "object": "email", "id": "cmu...", "subject": "Invoice 42", "read_at": null } ],
  "unread_count": 3
}

{ "read": true }

{ "object": "email", "id": "cmu...", "read_at": "2026-10-02T10:00:00.000Z" }

{ "ids": ["cmu1...", "cmu2..."], "read": true }

{ "object": "list", "read": true, "updated": 2 }