Automatize
Products · 14 · Communication Delivery
← All products

Outboundly

A transactional email API in front of your own mail server — and everything that makes it actually deliver.

Your applications POST JSON and get an audited send. Behind that sits the operational work nobody wants to do by hand: domain ownership verification, DKIM key generation, ready-to-publish DNS records, mail-server map generation and reload, and TLS certificates that renew themselves.

Request a demo →Download brochure (PDF, EN) ↓
90Day retention ceiling
0Message bodies stored
11Client code languages
1,730Automated tests
The problem

Two bad options: hand your mail to a foreign service, or run Postfix by hand.

Hosted senders are easy but put every password reset, invoice and notification your customers receive through infrastructure in someone else's jurisdiction, priced per thousand. Running your own Postfix keeps the data but hands your team DKIM keys, DNS records, virtual maps, certificate renewals and a queue that occasionally backs up at three in the morning.

01
Data leaves
Every recipient address and subject line is processed outside your control.
02
Priced per thousand
A bill that grows with the thing your product does automatically.
03
Deliverability by hand
DKIM, SPF and DMARC set up once by someone who has since left.
04
No answer at 3am
Mail is stuck and the only tool is an SSH session and a man page.
The solution

Keep your own mail server. Put a proper API and an operator console on top of it.

01
The credential is the boundary
An API key is scoped to specific mailboxes. The sending address is never a request parameter, so there is nothing for a compromised caller to lie about.
02
Audited before it is sent
The audit row is written before the transport is asked, in its own transaction. A failed send is a logged failure, never an absent row.
03
Bodies are never stored
Addresses, subject, counts and outcome are recorded — never message content. Retention is a ceiling in the code, not a setting somebody can quietly raise.

Against the alternatives

01
A hosted sending service
Priced per thousand messages, with recipients and subject lines processed off-site.
02
Raw SMTP from the application
No audit trail, no key scoping, no retry policy and no operator view.
03
Postfix administered by hand
DKIM, DNS, mail-server maps and certificates all depend on somebody's memory.
04
A shared relay account
One credential that can send as anyone, with no way to revoke access narrowly.

Capabilities

01The Email API
  • A JSON send endpoint served under two version prefixes, with a build-failing test that stops a controller silently dropping off the older one
  • Recipients, copies, subject, HTML body, attachments and reply-to, with per-mailbox defaults applied on every send
  • Limits enforced in three independent layers: 20 recipients, 20 copies, 5 attachments, 10 MB each, 25 MB total — over the limit is a rejection, never a silent truncation
  • No blind-copy request field, by design — a blind copy is a mailbox policy, not something a caller sets
  • Delivery retried three times with exponential backoff; permanent failures are not retried
  • Header injection defended by stripping line breaks from every header-bound value
02Domains, DNS & DKIM
  • Ownership verified over TXT and MX independently, each tracked separately, with an administrator override enforced in the service
  • DKIM key generation at 2048 bits, with signing tables maintained for you — the private key never enters the application or database
  • Ready-to-publish SPF, DKIM, DMARC and MX records, presented in tabbed modals with per-field copy buttons
  • A guided verification page including a panel of common DNS provider instructions
  • Attachment types recognised by extension; filenames rejected if they carry path or shell characters
03Credentials, Access & TLS
  • API keys generated securely, stored only as a hash, shown in plaintext exactly once
  • Revoked rather than deleted, so historical sends keep their audit trail intact
  • Per-user, per-mailbox grants for primary, send and manage rights through a join table
  • Mailbox passwords hashed in the format the mail server itself expects
  • Certificates issued and renewed automatically, with both HTTP and DNS challenge types supported
  • Renewal on a schedule, by default thirty days before expiry
  • Every certificate records issue, expiry and renewal dates, serial, issuer, challenge type, last error and attempt count
04Mail-Server Operations & Log Console
  • Map generation and reload — domains and mailboxes rendered from the database, compiled, validated and reloaded on demand or on a schedule
  • Queue management: list and filter, hold, release, requeue or delete a message, singly or in bulk
  • Queue statistics, per-directory counts, and summaries by sender and recipient
  • Full message inspection — envelope, headers and body — for anything stuck
  • Search the mail, error, warning and system logs, including rotated and compressed files, with live tail
  • Configuration file editor confined to a directory allow-list, with templates, timestamped backups, validate, reload and restart
  • Command-injection defences throughout: allow-listed commands validated at start-up, pattern-constrained identifiers and paths
05Audit Record & Developer Experience
  • A row for every send attempt, written before the transport is asked, in its own transaction
  • Records the key, application, mailbox, addresses, subject, counts, time, status, attempt count and error — never the message body
  • Retention clamped to ninety days in code, logged when a larger value is requested
  • Purge runs in bounded batches, deleting rows before files, then sweeping whole date directories
  • An in-product API explorer with grouped operations, schema tables and a live try-it form
  • Generated client code in eleven languages, including COBOL, Fortran and RPG, with twenty-five more samples on the public site
  • An SMS queue with destination-prefix rules and an API for an external gateway to collect and report on messages
■Java 21 on Spring Boot; PostgreSQL database
■26 controllers under two API version prefixes, with OpenAPI and an in-product explorer
■Server-rendered front end with hand-written JavaScript — no package manager, no bundler
■Automated TLS issuance and renewal with HTTP and DNS challenge support
■Single node, service unit and reverse proxy; installation guide covers a clustered mail topology
■1,730 tests across 111 classes — roughly one line of test per line of production code

What it does

  • 01An audited send API on top of your own Postfix — no hosted sender, no per-thousand pricing.
  • 02Message bodies are never stored; retention is clamped to ninety days in code, not a setting.
  • 03Client code generated in eleven languages, including COBOL, Fortran and RPG, for legacy estates.

At a glance

For whomSoftware vendors · MSPs · Hosting providers · Privacy-led buyers
LicenceOutboundly is licensed per installation, not per thousand messages sent. The annual fee is based on your own turnover on a marginal schedule, starting at a €900 minimum with any yearly increase capped at 25%. Hosting and hardware are your own; consultancy, setup, migration and training are quoted separately.

Outboundly in your organisation?

Start the conversation →