Posthaste

You POST a message; Posthaste signs it with your domain's DKIM key, delivers it straight to the recipient's mail server, catches the bounce on the way back and keeps the receiving server's reply word for word. It covers sending (API or SMTP), receiving (inbound mail arrives as a signed webhook) and verification codes in one account. Marketing mail is refused on purpose, to protect the sending IP.

• Outbound and inbound mail servers, a 115-endpoint REST API (OpenAPI 3.1), a Next.js dashboard and a React Native app.
• Per-domain DKIM signing, IP warm-up enforced when a message is accepted, bounce and complaint handling, and DMARC aggregate report ingestion. Mail passes SPF, DKIM and DMARC at Gmail.
• SDKs published for TypeScript, Python, Ruby, PHP and Go, plus an MCP server so AI agents can send through scoped tools.

• A message counts as accepted only once it is stored: the message, its delivery job and its first event are written in one transaction before the API replies.
• Load-tested on the production stack with nearly a million messages, with none lost or accepted twice. The test also showed the next bottleneck (intake and delivery competing for the same database), which is documented.
• Tenants isolated with PostgreSQL row-level security; delivery and billing logs are append-only and hash-chained; message bodies encrypted with AES-256-GCM; off-site backups checked by an actual restore.