Inbound SMTP
Deliver to a configured recipient, reject an unknown recipient, enforce the size limit, and verify TLS and authentication policy.
Mail guide
Receive, store, read, and send application mail.
Configure the certificate, mail server, account, and mailbox in order; restart the protocol services; then test SMTP and IMAP with real clients.
- SMTP
- IMAP
- Outbox retry
Build the mail hierarchy.
- Create or import a TLS certificate for the mail hostname.
-
Create an enabled
mail_serverwith an intentional listen interface, TLS mode, maximum message size, client limit, and authentication policy. - Restart the latest release so SMTP initializes the new server.
- Create a
mail_accountlinked to that server. - Create and subscribe an INBOX mailbox linked to the account.
- Enable IMAP, set its hostname and listen interface, then restart.
Test mail as a protocol, not a database row.
IMAP
Authenticate, list mailboxes, fetch and search messages, change flags, exercise IDLE, and verify cross-account isolation.
Outgoing actions
Send through a permissioned custom action using the internal mail performer; there is no direct public mail-send REST endpoint.
Email actions guide →Outbox processing
Exercise temporary failure, retry scheduling, final failure, and duplicate-safe downstream behavior.
Prepare the domain and storage.
- DNS records, reverse DNS, SPF, DKIM, and DMARC match the deployment's sending role.
- Trusted TLS is used for public SMTP and IMAP clients.
- Mail table gates allow intended users while row permissions keep messages owner-scoped.
- Raw message storage and SQL mailbox metadata are backed up together.
- Mail retries provide at-least-once behavior, not exactly once.
- Open relay behavior is explicitly tested and denied.
Delivery drill
Exercise failure before mail matters.
Send one disposable message through a permissioned action, verify it enters the outbox, and observe the delivery record. Then point the test environment at a unavailable SMTP destination and confirm bounded retry scheduling.
Restore delivery and check the final state. Build duplicate-safe downstream behavior: a crash after SMTP acceptance but before success is recorded can cause the same message to be attempted again.