SMTP Relay

Examail runs its own self-hosted mail node. Instead of the REST API, you can authenticate any SMTP-speaking application directly against it — useful for off-the-shelf software you don't control the code of.

Drop-in SMTP

Point WordPress, a legacy PHP app, Postfix, or any SMTP-capable library at mail.sendexa.co — no SDK, no REST integration.

Per-app credentials

Issue a dedicated username/password per application from the dashboard — revoke one without touching the others.

Domain-ownership enforced

Postfix itself rejects any send where 'From' isn't a domain you've verified — spoofing another business's domain is impossible.

Same wallet, billed live

Every accepted send debits your wallet balance synchronously — insufficient funds means a clean SMTP rejection, not a silent drop.

Host

mail.sendexa.co

Port / Encryption

587 · STARTTLS

Auth

PLAIN (user/pass)

1. Create a credential

SMTP credentials are issued from the dashboard (Examail → SMTP Relay → New Credential) — this is a separate, session-authenticated flow from the API-key-based REST endpoints on this site, since a credential is meant to be pasted into another application's SMTP settings, not embedded in your own backend alongside your API key.

JSON

// Shown once at creation time — copy it now
{
  "username": "smtp_b7baa58c4aa59088",
  "secret": "m8Cw8IzTSLbKMpL2h2f7r9ejg52F4RnF",
  "host": "mail.sendexa.co",
  "port": 587
}

The secret is shown once

Only a hash is stored server-side — if you lose the secret, revoke the credential and issue a new one. Give each application its own credential so you can revoke individually without rotating everything.

2. Configure your application

Any SMTP client works. Two common examples:

JavaScript

const nodemailer = require("nodemailer");

const transporter = nodemailer.createTransport({
  host: "mail.sendexa.co",
  port: 587,
  secure: false,      // STARTTLS, not implicit TLS
  requireTLS: true,
  auth: {
    user: "smtp_b7baa58c4aa59088",
    pass: "m8Cw8IzTSLbKMpL2h2f7r9ejg52F4RnF",
  },
});

await transporter.sendMail({
  from: '"Acme" <hello@yourdomain.com>', // must be a verified domain
  to: "user@example.com",
  subject: "Hello from Examail SMTP relay",
  html: "<p>Sent without touching the REST API.</p>",
});

What happens on every send

Stage	Check	On failure
RCPT TO	Is this recipient on your suppression list?	550 rejection for that recipient
Sender domain	Is the From: domain verified and owned by you?	553 5.7.1 Sender address rejected
End of message	Does your wallet have balance for the flat per-email rate?	550 5.7.1 rejection, nothing is charged

A successful send creates an EmailMessage record (provider: "postfix-smtp") visible via GET /v1/email/history just like REST-API sends.

Billing: flat rate, no attachment surcharge

SMTP relay is billed at the same flat per-email base rate as the REST API ($0.0001/email). Unlike REST API sends, the attachment-size surcharge doesn't apply here — Examail's SMTP layer validates recipients and billing before seeing the full message body, so it can't inspect attachment sizes the way the REST API does.

Current limitations

No bounce/DSN tracking yet.A message accepted here that later bounces at the recipient's server won't update your suppression list or fire a webhook the way REST API sends do — only a MESSAGE_SENT-equivalent record is created at accept time.
No per-credential rate limiting beyond your wallet balance — the balance check is the only throttle today.
No IP allowlisting per credential yet.

Best Practices

Issue one credential per application, not one shared credential for everything — makes revocation surgical.
Always send from a domain you've verified — see Domains.
If you need attachment-aware billing, bounce tracking, or webhooks today, use the REST API instead — SMTP relay is best for off-the-shelf software you can't integrate the API into.
Revoke a credential immediately if it may have leaked — it takes effect within a few minutes.