Skip to main content
Live. This area is documented as current, user-reliable behavior.

​
Goal

Route incoming email into a workspace while keeping raw content encrypted, scanned, filtered, and auditable.

​
Prerequisites

  • DNS control for the inbound domain or a supported StackShift-managed domain
  • A StackShift API key

​
Workflow

1
Create an inbound domain and publish the returned MX and verification TXT records.
2
Verify the domain before routing production mail to it.
3
List and filter received messages, then inspect parsed envelope, headers, text, sanitized HTML, authentication results, and attachments.
4
Request short-lived private downloads only for clean raw MIME or attachments.

​
Intake and storage behavior

  • MX points to inbound.mail.stackshift.cloud; _stackshift-mail TXT proves domain ownership.
  • HTML is sanitized before it is returned to applications.
  • Raw MIME and attachment objects are encrypted in object storage.
  • Attachments expose scan verdict, checksum, content type, inline state, size, and retention deadline.
  • Quarantined content cannot be downloaded; clean downloads are short-lived and use Cache-Control: private, no-store.

​
Filtering, replies, and revalidation

  • Message lists can filter by domain, recipient, sender, status, date range, cursor, and limit.
  • StackShift reply addresses correlate inbound replies to the original outbound message and emit mail.message.replied.
  • Verified domains are revalidated; DNS regression can pause routing until records are repaired and verified again.

​
Expected result

Incoming mail is associated with the owning workspace and can be consumed without exposing unscanned or unencrypted content.

​
Common failures

  • Publishing only one required DNS record
  • Expecting intake before verification
  • Downloading quarantined content
  • Ignoring retention deadlines

Events, webhooks, and timelines

List mail events, inspect per-message timelines, subscribe webhooks, rotate secrets, retry deliveries, and verify webhook signatures.

Diagnostics, analytics, and exports

Diagnose rendered templates, measure Mail operations, and create encrypted recipient-level delivery exports.

Sender domains and DNS

Create and verify outbound sender domains, inspect SPF, DKIM, DMARC, and return-path record status, and know what the domain status fields mean.