> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackshift.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Inbound mail

> Receive mail on verified domains, inspect parsed messages, and securely download scanned raw messages and attachments.

<Tip>
  **Live.** This area is documented as current, user-reliable behavior.
</Tip>

## Goal

Route incoming email into a workspace while keeping raw content encrypted, scanned, filtered, and auditable.

## Prerequisites

* DNS control for the inbound domain or a supported StackShift-managed domain
* A StackShift API key

## Workflow

<Steps>
  <Step>
    Create an inbound domain and publish the returned MX and verification TXT records.
  </Step>

  <Step>
    Verify the domain before routing production mail to it.
  </Step>

  <Step>
    List and filter received messages, then inspect parsed envelope, headers, text, sanitized HTML, authentication results, and attachments.
  </Step>

  <Step>
    Request short-lived private downloads only for clean raw MIME or attachments.
  </Step>
</Steps>

## Intake and storage behavior

* MX points to `inbound.mail.stackshift.cloud`; `_stackshift-mail` TXT proves domain ownership.
* HTML is sanitized before it is returned to applications.
* Raw MIME and attachment objects are encrypted in object storage.
* Attachments expose scan verdict, checksum, content type, inline state, size, and retention deadline.
* Quarantined content cannot be downloaded; clean downloads are short-lived and use `Cache-Control: private, no-store`.

## Filtering, replies, and revalidation

* Message lists can filter by domain, recipient, sender, status, date range, cursor, and limit.
* StackShift reply addresses correlate inbound replies to the original outbound message and emit `mail.message.replied`.
* Verified domains are revalidated; DNS regression can pause routing until records are repaired and verified again.

## Expected result

<Check>
  Incoming mail is associated with the owning workspace and can be consumed without exposing unscanned or unencrypted content.
</Check>

## Common failures

<Warning>
  * Publishing only one required DNS record
  * Expecting intake before verification
  * Downloading quarantined content
  * Ignoring retention deadlines
</Warning>

## Related guides

<CardGroup cols={2}>
  <Card title="Events, webhooks, and timelines" href="/stackshift-mail/events-webhooks-and-timelines">
    List mail events, inspect per-message timelines, subscribe webhooks, rotate secrets, retry deliveries, and verify webhook signatures.
  </Card>

  <Card title="Diagnostics, analytics, and exports" href="/stackshift-mail/diagnostics-analytics-and-exports">
    Diagnose rendered templates, measure Mail operations, and create encrypted recipient-level delivery exports.
  </Card>

  <Card title="Sender domains and DNS" href="/stackshift-mail/sender-domains-and-dns">
    Create and verify outbound sender domains, inspect SPF, DKIM, DMARC, and return-path record status, and know what the domain status fields mean.
  </Card>
</CardGroup>