Inbound email
Receive email on your domains and hand it to your app
Point your MX records at Mail.Land, decide per address what happens to each message, and receive it as signed, parsed JSON. Support inboxes, reply handling and machine-generated mail all start here.
{
"event": "inbound.received",
"event_id": "evt_3f9c...",
"schema_version": 1,
"data": {
"idempotency_key": "k7m2x9q4p1w8z3_r2d8...",
"email": {
"envelope": {
"from": "[email protected]",
"to": ["[email protected]"]
},
"headers": { "subject": "Re: order 1042" },
"body": { "text_preview": "Hi, the parcel...", "has_html": true },
"attachments": [{
"file_name": "photo.jpg",
"size_bytes": 482113,
"download_url": "https://..."
}],
"authentication": {
"spf": { "result": "pass" },
"dkim": { "result": "pass" },
"dmarc": { "result": "pass" }
},
"spam": { "is_spam": false }
},
"matched_route": { "id": "r2d8...", "name": "support" }
}
}How inbound works
Set up inbound and routes in the dashboard or through the API, and publish the MX records with your DNS provider.
1. Point your MX records
Add the MX records for your domain and switch inbound on for it. Mail.Land accepts mail only for addresses that match one of your routes, or for any address when catch-all is on; everything else is refused before it is accepted.
2. Create routes
A route matches the part of the address before the @ and runs one or more actions. Routes are checked in the priority order you set, and you can test which route an address would match before any mail arrives.
3. Receive the message
Mail.Land parses the headers, body and attachments, checks SPF, DKIM and DMARC, and then stores the message, posts it to your webhook or forwards a copy, as the route says.
What a route can do
Routes match exactly, by prefix, suffix or substring, by plus addressing (support+anything), as a catch-all, or by regular expression.
| What happens | Combine with others | |
|---|---|---|
| Store | Keeps the parsed message for the dashboard and the API, for 1 to 90 days (30 by default) | Yes, with webhook and forward |
| Webhook | Posts the parsed message to one of your webhooks as signed JSON | Yes, with store and forward |
| Forward | Sends a copy to another address through the normal sending path; the route's domain must be verified for sending | Yes, with store and webhook |
| Reject | Refuses the message at SMTP with the status and text you choose | No, it must be the only action |
| Drop | Accepts the message and discards it: nothing is stored or posted | No, it must be the only action |
| Unsubscribe mailbox | Treats the address as the mailbox behind your List-Unsubscribe header | No, it must be the only action |
Regular-expression routes need the Pro or Max plan. Routes never match on the sender, the subject or other headers.
What you receive for each message
The same message information in the webhook body, the dashboard and the API, each in its own format.
Parsed, signed JSON
Envelope sender and recipients, the From, To, Cc, Subject and Reply-To headers, a text preview and the matched route, signed with HMAC-SHA256 like every Mail.Land webhook.
Attachments as links
Each attachment comes with its name, type, size and a download link valid for 15 minutes. Its ID stays the same on every retry, so you can tell what you already downloaded.
Authentication and spam results
SPF, DKIM and DMARC results and a spam flag with its score on every message, so your code can decide what to trust.
Full body and raw message
While a message is stored, fetch its text and HTML body through the API (very large HTML is left out) or download the original message as an .eml file.
Replay and deduplication
Every delivery carries a stable event ID and idempotency key for deduplication. You can replay a message to its webhook by hand; a replay gets a new event ID that points to the original.
Control over what gets in and what goes out
Inbound mail is a door into your systems, so Mail.Land gives you the checks to keep it narrow.
Sender allowlist and blocklist
Allowlisted senders skip spam filtering. A blocklisted sender is refused at SMTP, marked as spam or silently dropped, as you choose. Spam-flagged mail waits in a quarantine you can review; releasing a message clears its spam flag, and a manual replay then sends it to your webhook.
Forwarding needs consent
Before anything is forwarded to an address outside your own domains verified for sending, its owner receives a confirmation link, valid for 7 days. A decline is final.
What is never forwarded
Mail flagged as spam, mail that fails DMARC under a quarantine or reject policy, oversized mail and mail that would loop is not forwarded and not billed. Each forwarded copy counts as one send on your plan.
Good to know before you start
The limits, stated plainly.
Routing by recipient only
Routes look at the part of the recipient address before the @. Sender or subject rules belong in your own code, using the webhook fields.
25 MiB per message
You can set a lower maximum per domain, and a daily limit on accepted messages. Larger messages are refused at SMTP.
Retention you set
Stored messages are kept for 1 to 90 days per domain, 30 by default, and then deleted.
No virus scanning
Mail.Land does not scan attachments for malware. Treat every attachment as untrusted in your application.
Preview in the webhook
The webhook carries a text preview, not the full body. Fetch the body or the raw message from the API while the message is stored.
Inbound email questions
Do I have to move my whole domain's mail to Mail.Land?
No. Inbound runs on the domains whose MX records point to Mail.Land. Many teams use a subdomain, such as replies.yourdomain.com, and keep their normal mailboxes where they are.
Can I check how the sender of a message authenticated?
Yes. Every message carries its SPF, DKIM and DMARC results, such as pass, fail or none, in the webhook body and in the API. They tell your code what the checks found, not who the sender is. Forwarding also skips mail that fails DMARC under a quarantine or reject policy.
How do I get the attachments?
Each attachment in the webhook has a download link that works for 15 minutes without an API key. After that, download it through the API or fetch the raw message.
Can the same message reach my webhook twice?
Yes, delivery is at least once: a retry after a timeout on your side can repeat a delivery. Every automatic retry of an event carries the same event ID, so store the IDs you processed and skip repeats. A manual replay gets a new event ID.
Does forwarding count against my plan?
Yes. A forwarded copy is a new email sent through the normal sending path, so each one counts as one send. Copies that are never forwarded, such as spam, are not billed.
Which plans include inbound email?
Inbound routes are part of the platform; regular-expression routes need the Pro or Max plan. The pricing page lists what each plan includes.
Start receiving email on your domain
Create a free account, add your domain and set up your first route.