Mailstack
Our own mail plane: sending, receiving and submission, each on its own legs.
Mailstack is how everything we run sends and receives email. Three separate services — outbound delivery, inbound reception, and authenticated submission — each with its own tenants, its own limits and its own failure domain.
Why we stopped renting email
Delivery providers price per message, hold your reputation, read your envelope, and give you one shared pool to fail in. Every product we ship needs transactional mail, and every one of them was one vendor incident away from silence — with no way to see why a message never arrived.
So we own the whole path: the queue, the signature, the reputation, and the bounce that tells us the truth.
What it does
Three services, three blast radii
Submission, outbound delivery and inbound reception run as separate services with separate state. A flood of inbound mail cannot stall your outbound queue, and a delivery incident cannot take submission offline.
Tenants that stay apart
Every customer gets its own tenant: its own credentials, its own sending identity, its own queue accounting and its own stored mail. Nothing is shared except the wire.
Per-tenant sending identity
Each tenant sends from its own subdomain, signed as itself, so reputation is earned and spent per tenant instead of pooled across everyone on the platform.
Authenticated everything
Outbound mail is signed and aligned to the published policy for its domain, so receivers can prove it came from us and reject anything that did not.
Bounces attributed to their owner
Inbound delivery reports are routed back to the tenant that caused them, so a dead recipient list is visible to the team that owns it rather than to nobody.
Pacing built for reputation
Delivery is rate-limited per destination with a warmup ramp for new addresses, and retries back off on their own schedule instead of hammering a provider that just throttled us.
How we build it
- One tenant should never be able to spend another tenant’s reputation.
- A message is either delivered, deferred, or explained — never silently gone.
- Each service must be restartable on its own, mid-incident, without the others noticing.
Mailstack is infrastructure we operate. Tenants are provisioned by us for the products and customer workloads we host — there is no self-serve sign-up.