Outboundly
A transactional email API in front of your own mail server — and everything that makes it actually deliver.
Your applications POST JSON and get an audited send. Behind that sits the operational work nobody wants to do by hand: domain ownership verification, DKIM key generation, ready-to-publish DNS records, mail-server map generation and reload, and TLS certificates that renew themselves.
90Day retention ceiling
0Message bodies stored
11Client code languages
1,730Automated tests
The problem
Two bad options: hand your mail to a foreign service, or run Postfix by hand.
Hosted senders are easy but put every password reset, invoice and notification your customers receive through infrastructure in someone else's jurisdiction, priced per thousand. Running your own Postfix keeps the data but hands your team DKIM keys, DNS records, virtual maps, certificate renewals and a queue that occasionally backs up at three in the morning.
01
Data leaves
Every recipient address and subject line is processed outside your control.
02
Priced per thousand
A bill that grows with the thing your product does automatically.
03
Deliverability by hand
DKIM, SPF and DMARC set up once by someone who has since left.
04
No answer at 3am
Mail is stuck and the only tool is an SSH session and a man page.
The solution
Keep your own mail server. Put a proper API and an operator console on top of it.
01
The credential is the boundary
An API key is scoped to specific mailboxes. The sending address is never a request parameter, so there is nothing for a compromised caller to lie about.
02
Audited before it is sent
The audit row is written before the transport is asked, in its own transaction. A failed send is a logged failure, never an absent row.
03
Bodies are never stored
Addresses, subject, counts and outcome are recorded — never message content. Retention is a ceiling in the code, not a setting somebody can quietly raise.
Against the alternatives
01
A hosted sending service
Priced per thousand messages, with recipients and subject lines processed off-site.
02
Raw SMTP from the application
No audit trail, no key scoping, no retry policy and no operator view.
03
Postfix administered by hand
DKIM, DNS, mail-server maps and certificates all depend on somebody's memory.
04
A shared relay account
One credential that can send as anyone, with no way to revoke access narrowly.
Capabilities
01The Email API
- A JSON send endpoint served under two version prefixes, with a build-failing test that stops a controller silently dropping off the older one
- Recipients, copies, subject, HTML body, attachments and reply-to, with per-mailbox defaults applied on every send
- Limits enforced in three independent layers: 20 recipients, 20 copies, 5 attachments, 10 MB each, 25 MB total — over the limit is a rejection, never a silent truncation
- No blind-copy request field, by design — a blind copy is a mailbox policy, not something a caller sets
- Delivery retried three times with exponential backoff; permanent failures are not retried
- Header injection defended by stripping line breaks from every header-bound value
02Domains, DNS & DKIM
- Ownership verified over TXT and MX independently, each tracked separately, with an administrator override enforced in the service
- DKIM key generation at 2048 bits, with signing tables maintained for you — the private key never enters the application or database
- Ready-to-publish SPF, DKIM, DMARC and MX records, presented in tabbed modals with per-field copy buttons
- A guided verification page including a panel of common DNS provider instructions
- Attachment types recognised by extension; filenames rejected if they carry path or shell characters
03Credentials, Access & TLS
- API keys generated securely, stored only as a hash, shown in plaintext exactly once
- Revoked rather than deleted, so historical sends keep their audit trail intact
- Per-user, per-mailbox grants for primary, send and manage rights through a join table
- Mailbox passwords hashed in the format the mail server itself expects
- Certificates issued and renewed automatically, with both HTTP and DNS challenge types supported
- Renewal on a schedule, by default thirty days before expiry
- Every certificate records issue, expiry and renewal dates, serial, issuer, challenge type, last error and attempt count
04Mail-Server Operations & Log Console
- Map generation and reload — domains and mailboxes rendered from the database, compiled, validated and reloaded on demand or on a schedule
- Queue management: list and filter, hold, release, requeue or delete a message, singly or in bulk
- Queue statistics, per-directory counts, and summaries by sender and recipient
- Full message inspection — envelope, headers and body — for anything stuck
- Search the mail, error, warning and system logs, including rotated and compressed files, with live tail
- Configuration file editor confined to a directory allow-list, with templates, timestamped backups, validate, reload and restart
- Command-injection defences throughout: allow-listed commands validated at start-up, pattern-constrained identifiers and paths
05Audit Record & Developer Experience
- A row for every send attempt, written before the transport is asked, in its own transaction
- Records the key, application, mailbox, addresses, subject, counts, time, status, attempt count and error — never the message body
- Retention clamped to ninety days in code, logged when a larger value is requested
- Purge runs in bounded batches, deleting rows before files, then sweeping whole date directories
- An in-product API explorer with grouped operations, schema tables and a live try-it form
- Generated client code in eleven languages, including COBOL, Fortran and RPG, with twenty-five more samples on the public site
- An SMS queue with destination-prefix rules and an API for an external gateway to collect and report on messages
06Security & governance
- API keys hashed at rest, revealed once, revocable, and scoped to individual mailboxes
- bcrypt for user passwords; the mail server's own hash format for mailboxes
- Rate limiting on login, registration, validation and test paths, with the retry hint returned to the caller
- Request-forgery protection on the administration pages, with the fetch and interaction layers patched to carry the token
- Cookies hardened; header injection blocked on every header-bound parameter
- Command-injection defences: allow-listed shell commands validated at start-up, pattern-constrained identifiers and a directory allow-list for configuration edits
- Mass-assignment defences on the wizard forms and on registration
- Audit rows written ahead of the send, and a ninety-day retention ceiling clamped in code
- Dependency vulnerability scanning available in the build, with several fixes pinned explicitly
■Java 21 on Spring Boot; PostgreSQL database
■26 controllers under two API version prefixes, with OpenAPI and an in-product explorer
■Server-rendered front end with hand-written JavaScript — no package manager, no bundler
■Automated TLS issuance and renewal with HTTP and DNS challenge support
■Single node, service unit and reverse proxy; installation guide covers a clustered mail topology
■1,730 tests across 111 classes — roughly one line of test per line of production code
Industries
Who it works for
Software vendors
Password resets, notifications and receipts from your product, with per-application, per-mailbox keys so one customer cannot send as another.
Managed service providers
Transactional mail for many client applications, sent from infrastructure you already run and already bill for.
Hosting providers
The queue, log and configuration console turns mail support from an SSH session into a screen a junior can use.
Privacy-led organisations
No message body is ever stored and the audit window is a hard ninety days: a defensible answer rather than a policy document.
Public sector
Self-hosted and European, where sending citizen correspondence through a foreign service is not procurable.
Healthcare-adjacent
Appointment and result notifications where the recipient list itself is sensitive and must stay inside your own estate.
Financial services
Statement and alert delivery with a per-send audit record and a signed, verifiable sending domain.
Belgian & Benelux business
Built in Belgium: European hosting, European defaults, and an operator model that assumes you own the mail server.
Legacy integration shops
Client code generated for COBOL, Fortran and RPG alongside modern languages, for mainframe and midrange estates.
Use cases
Example scenarios
01 · Software vendors
Scoped sending keys instead of one shared relay account
- Challenge
- A SaaS vendor sent password resets and invoices for all its customer environments through one SMTP relay account. That credential could send as any address, there was no record of what went out, and a failed send simply disappeared.
- Approach
- Each application gets its own API key, scoped to specific mailboxes, hashed at rest and shown only once; the sending address comes from the key, never from the request. Every attempt gets an audit row before the transport is called, and delivery is retried three times with exponential backoff.
- Result
- A leaked key can be revoked for one application without touching the others, and support can answer whether a message was sent by querying the audit record.
02 · Hosting providers
Stuck mail handled from a console, not an SSH session
- Challenge
- A hosting company runs Postfix for its customers, and only one senior engineer knew the commands to inspect or flush the queue. When mail backed up at night, tickets waited until that person was available.
- Approach
- The operator console lists and filters the queue, shows envelope, headers and body of a stuck message, and holds, releases, requeues or deletes messages singly or in bulk. Mail, error and system logs, including rotated and compressed files, are searchable with live tail, and configuration edits are backed up, validated and reloaded from the same screen.
- Result
- First-line staff can diagnose and clear a backed-up queue themselves, and the senior engineer is only involved for real configuration problems.
03 · Public sector
Citizen notifications from a verified, self-hosted sending domain
- Challenge
- A local authority sends permit updates and appointment confirmations from its case-management software. A hosted sender outside the EU was ruled out under GDPR, and the in-house Postfix had DKIM and DNS records set up years ago by someone who had since left.
- Approach
- Outboundly verifies the domain over TXT and MX, generates a 2048-bit DKIM key and hands over ready-to-publish SPF, DKIM, DMARC and MX records, with a guided verification page. TLS certificates are issued and renewed automatically, and the audit record keeps addresses, subject and outcome, never the message body, for at most ninety days.
- Result
- Citizen mail leaves from the authority's own infrastructure on a signed domain, and the data protection officer has a concrete answer on what is stored and for how long.
Licence
Per deployment. Never per seat.
Outboundly is licensed per installation, not per thousand messages sent. The annual fee is based on your own turnover on a marginal schedule, starting at a €900 minimum with any yearly increase capped at 25%. Hosting and hardware are your own; consultancy, setup, migration and training are quoted separately.
Annual licence by turnover, ex VAT
| Turnover | Per year |
|---|
| Up to €500k | €900 |
|---|
| €1M | €1,500 |
|---|
| €5M | €2,500 |
|---|
| €25M | €5,500 |
|---|
| €100M | €13,000 |
|---|
| €500M | €37,000 |
|---|
| €1B | €52,000 |
|---|
Illustrative: a hosted sender at €0.80 per thousand messages bills a twenty-million-message year €16,000; at €5M turnover this is €2,500.
What it does
- 01An audited send API on top of your own Postfix — no hosted sender, no per-thousand pricing.
- 02Message bodies are never stored; retention is clamped to ninety days in code, not a setting.
- 03Client code generated in eleven languages, including COBOL, Fortran and RPG, for legacy estates.
At a glance
CategoryCommunication Delivery
LicencePer deployment, unlimited users, from €900 a year
For whomSoftware vendors · MSPs · Hosting providers · Privacy-led buyers
Point one domain at it.
Verify it, generate the DKIM key, publish the four records we hand you, and send one message. It takes an afternoon.Start the conversation →