Email Sending

What Email Sending Is

Email Sending lets your websites and other systems send email from your own domains, through your own Amazon SES account. Your workspace owns all of it: the domains you send from, the logins that may send, the list of people who must never be emailed, the proof of consent, and the log of what was sent. Nothing about it is kept outside your workspace. When a message goes out, your workspace hands it to MountDev's shared engine together with your Amazon keys for that one message. The engine keeps nothing, and the keys are never saved or logged outside your workspace (Keys Sent With Each Call).

This is separate from Email Delivery, which is how your workspace sends its own email, such as Helpdesk replies and receipts.

Owners and admins manage it, and so can anyone whose role allows setting up sending domains and logins (Settings, Permissions). AI agents and API keys never can.

Before You Start

• Add the Campaigns app. It keeps the suppression list and the consent records that every email you send is checked against. Without it, nothing is sent.
• Connect Amazon Web Services in Settings, Connections, Connected Services, with an access key that may send email.
• Make your workspace's engine token in Settings, Connections, Engine Token (Engine Token).

Sending Domains

A sending domain is the domain your email comes from, such as example.com. Add Domain (action core.mail.domain.add) sets it up with your Amazon account and shows how many of the needed settings were found. Check Again (action core.mail.domain.check) looks again. Domains (action core.mail.domains) lists them with their logins and how many went out today.

You never copy a DNS record by hand. When the domain's DNS is not shared with MountDev yet, the only step shown is sharing it: inviting the address shown as a Cloudflare member with the DNS role only. If the DNS is not on Cloudflare, moving it there on the Free plan comes first. Setup waits, and a check runs again later.

A domain is Pending until it is verified, Verified when it can send, and Paused when too many emails bounced or too many people marked them as spam. Remove Domain (action core.mail.domain.remove) stops sending from a domain and turns off its logins. Nothing is deleted: the log stays.

Warm-Up

A newly verified domain sends a limited number a day at first, so its reputation grows safely: 50 on its first day, then 100, 200, 400, 800, 1,500, 2,500, 4,000, 6,000, and 10,000 on its tenth, with no limit after that. A message that would go over the day's limit is not lost: the sender is told to try again, and email programs do.

Pausing

Once a domain has sent at least 100 in the last two days, it is paused when 10 in 100 bounced or 5 in 1,000 drew a spam complaint. While it is paused, every message from it is refused with the reason. After you fix the cause, Resume Sending (action core.mail.domain.resume) starts it again, counting from the next day.

Sending Logins

A login is a username and a password for one domain, for a website's mail settings or any program that sends by SMTP.

• Make a Login (action core.mail.login.create) chooses the domain, a name, and what it sends: Transactional (receipts, forms, and password resets) or Marketing (only to people who agreed). The password is shown once, with Copy. It is never shown again, to anyone.
• New Password (action core.mail.login.rotate) makes a new password. The old one stops working at once.
• Turn Off (action core.mail.login.revoke) stops a login at once.
• Logins (action core.mail.logins) lists them with their user names, the last four characters of the password, and when each last sent.

Only a one-way fingerprint of a password is kept, in your workspace. Five wrong passwords in 15 minutes lock a login for 15 minutes. A login can send only as its own domain: a message from any other domain is refused, whether in the envelope or in the From line.

Who an Email Is Never Sent To

Every recipient is checked against your Campaigns lists right before a message goes, and again right before a held message goes. An address is left out, with the reason in the delivery log, when it:

• unsubscribed (an unsubscribe is honored at once, for everything you send),
• bounced or marked an email as spam,
• asked to be forgotten,
• was added to the suppression list by hand,
• cannot receive email (your sending service said so),
• is on your Do Not Contact list,
• or, for a Marketing login, never agreed to get email or has not confirmed it.

If none of a message's recipients can be emailed, the whole message is refused with the reasons. If only some cannot, the rest are sent.

Business Hours

Email to people outside your company waits for your Business Hours (Hours). A message that arrives while you are closed is accepted and held until the next opening, and the sender is told when. Messages of the kinds that go at once, such as a receipt for something a person just did, name their kind in an X-MDO-Kind header and go at any hour. See Held Email below for sending one early.

Held Email

Held Email (action core.mail.held) lists messages waiting for business hours, with when each will go. Send or Discard (action core.mail.held.act) sends one now or discards it. The message itself is kept encrypted in your own file storage, with the same protection as every stored file, until it goes. A message whose sending stopped part way is marked, never sent again by guessing.

The Delivery Log

Delivery Log (action core.mail.sends) shows one line for each recipient: who it went to, whether it was held, sent, delivered, left out, bounced, or failed, and why. It never shows a subject or a message. It can be searched by address (2 letters or more) and filtered by domain and status, 25 at a time.

When your sending service reports a bounce, a complaint, or a delivery, the line changes. A permanent bounce or a complaint puts the address on the suppression list for good and counts against the domain.

Limits

A message can be up to 150 KB and have up to 50 recipients. Each message you send counts as one email sent on Usage.

What Is Kept

In your workspace only: the domains, the fingerprints of passwords, the delivery log, held messages (encrypted), addresses that cannot receive email, and each domain's daily counts. Nothing is kept in the engine, in a log, or in the code. Your Activity Log records that a domain or login was made, changed, or turned off, never a password.

Good to Know

• Sending from the shared engine begins when your account is switched over. Until then, email keeps going the way it does today.
• Marketing campaigns from the Campaigns app are sent the way Campaigns describes; the lists they share with this page are the same.