Mailbox infrastructure

Mail that stays where you put it.

Real mailboxes on names you own. One request opens one, the four records are watched and reported record by record, and everything held under the name can leave any day.

Live today: the mailbox API. An address opens on one request, mail is accepted at the door and kept under the name, and each message is announced to your product as a signed webhook.

Not yet listening: JMAP, SMTP submission, CalDAV and CardDAV. Section 06 names each one, and none of them carries a date.

Open a docket Read the request

A name under service

Six gates hold, or the word is not used.

  • mx gate 2
  • spf gate 3
  • dkim gate 4
  • dmarc gate 5

50 GB included with every name

No uptime figure no operating history to measure yet

If one gate fails, the name reports by the failed gate rather than by a blank or a spinner: what was expected, what was found, and what happens next.

mx
Resolves to Ruzayo, and is the highest-priority record on the name.
spf
Present, and aligned with the sending identity.
dkim
Published and signing, with a named active key.
dmarc
Published with an explicit policy, and the policy is shown to you rather than chosen silently.

The two that are not records: domain control proven by a record only the holder of the name could have written, and an export of everything held under the name, producible at that moment. Amber marks a live quantity, something held. It never means good.

internet, port 25 accepted at the door kept under the name webhook, copy, forward or hold

01 · The request

One request opens a mailbox.

The verb is PUT, so the same request twice leaves you with the same mailbox rather than two. The token is server-side only: a credential in a browser or in an agent prompt is a credential you have given away.

The door
mail.ruzayo.com/ruzayo

  1. OpenPUT /v1/mailboxes/:address
  2. Receivemessage.received
  3. SendPOST /v1/send
  4. Hygienesuppression checked first

Bearer token, server-side. It never belongs in a browser.

The first exchange curl · HTTPS 
# 01 — open an address, once the name is under service
curl -X PUT https://mail.ruzayo.com/ruzayo/v1/mailboxes/agent%40yourdomain.com \
  -H "Authorization: Bearer $RUZAYO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"externalId":"agent_123","webhookUrl":"https://yourproduct.example/webhooks/ruzayo",
       "webhookSecret":"replace-with-a-secret-at-least-32-characters-long"}'

# 02 — send one message from it
curl -X POST https://mail.ruzayo.com/ruzayo/v1/send \
  -H "Authorization: Bearer $RUZAYO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"idempotencyKey":"first-001","from":"agent@yourdomain.com","to":["you@example.com"],
       "subject":"A first message","text":"It settles."}'
  • Boundarytenant and mailbox
  • Outboundour own queue, then the recipient MX
  • Final deliverynot implied
  • Repeat callsame key, same result

How long each part honestly takes

  • 1.4 s

    Measured create-to-listening — on a name that already listens. The first mailbox on a new name waits for the name.

  • 12 to 40 minutes

    A brand-new name, end to end. The long pole is your registrar and DNS propagation, and neither is ours to speed up.

  • One business day

    The published target for the human review that admits a name. A name is never admitted by software alone, and never auto-admitted.

What accepted means

Accepted means our own queue took the message for delivery. It does not mean the recipient's inbox took it. Nobody can promise the inbox. We promise alignment, hygiene, watchfulness — and the evidence. Our own queue target is under 2 s at our edge; past that it is an incident, and the alert fires at 1.2 s.

02 · What is under it

One house runs the whole thing.

Mail arrives by SMTP on port 25 and is kept under the name. Outbound leaves our own queue for the recipient MX. There is no upstream relay and no seam between two vendors for your mail to fall through.

A mailbox that is held or resting still receives and still keeps. Nothing already received is ever dropped — not while a record is broken, not while the account is unverified, not on the way out.

  1. 01 · receives

    At the door

    Internet mail arrives on port 25 and is handed to the store. A name can be activated or suspended without an operator editing a file, because the address registry the mail server checks is served live.

  2. 02 · keeps

    Kept under the name

    Each message is written to durable state, then announced to your product as an HMAC-signed webhook. If your endpoint is down the announcement is retried, and the attempt count is on the route.

  3. 03 · sends

    Direct to the recipient

    Outbound leaves our own queue for the recipient MX on port 25. No third party sits in the path, which also means nobody else's reputation is standing in for yours.

  4. 04 · signs

    One active key, named

    DKIM signs on the way out under one named active key, and the public half sits in your own DNS where anyone can read it. A retired key stays published, so mail signed before a rotation still validates.

03 · The sending caps

Sending is capped, and the caps do not move.

Four counters stand between an outbound message and the recipient: your account and the mailbox it leaves from, each counted by the day and by the minute. They are flat and they are set at the edge. Nothing raises them as a name ages, and nothing lowers them when a receiver complains. Receiving is never metered by volume and never rate-limited.

Outbound · what the edge enforces today

Counter Messages a day Burst a minute
One mailbox 50 10
Your account 1,000 100

The account figures are the pool every mailbox you hold draws from, so they are a ceiling and not a sum. Both scopes are read before a message leaves, and whichever is reached first is the one that answers.

  • 429

    what a send over a cap gets back, naming the counter it reached — never a silent drop

  • 0

    caps that move on their own — none rises with age, none falls on a complaint

The ramp is not built

  1. A schedule that lifts the caps as a name ages, from day 0–2 through day 14+, is a decision our capability matrix records. The edge reads no date, so nothing advances.
  2. The three conditions that would gate each step — the name listening, dmarc published with a policy other than none, refusals under 2% of attempts in the trailing 24 hours — are not consulted before a send.
  3. A pause that trips on refusals does not exist. The one stop that does is account-wide, and an operator sets it rather than a measurement.

Expected a ramp; found four flat counters. The mailbox numbers above are the schedule's first step and they stay there, so this is a commitment rather than a mechanism, and it carries no date. Raising a cap today is a conversation, not a threshold you cross. There is no dedicated IP.

04 · The stated word

Five words the system is allowed to say.

Five states, no sixth. Colour never carries a meaning on its own: every state is a dot and the word beside it, in the console, in the record, and in any mail we send you about your own mail.

listening
Receiving, and sending if sending is enabled. All six gates hold. Nothing is asked of you.
held
You placed a hold. Mail still arrives and is still kept; nothing is forwarded. A deliberate hold, not a fault.
wants you
A record broke or a webhook is failing. The only state that may notify, and never more than one at a time.
resting
30 days with no arrival. Still receiving, still priced, still exportable, and it never notifies — so a list of forty mailboxes tells you which four are alive.
refused
We declined it, and the reason is always given. It is not reversible in place.

Written, not coloured

Expected TXT at _dmarc. Found nothing. We can write it back.

acme.se refused this at the door: 550, sender not aligned. Here is what they checked.

Nothing needed you.

Every value that could exist and does not is named with a reason. Never a blank cell, never a greyed-out number, and never a spinner where a next check time belongs.

05 · The meter

Three numbers, and nothing else is priced.

No tiers, no minimum, no commitment, and no volume discount. The price is the same at four mailboxes and at four hundred, because published pricing exists to end negotiations rather than to open them.

Published in full: all three numbers, below. They are final and they do not move for a large customer.

Not yet running: the meter that would apply them. Nothing is charged today, and no invoice will arrive behind a price you have not already read here.

  • €3 / mo

    A name under service

    Each name you put under service, whether it carries one address or forty.

  • €3 / mo

    A mailbox held

    The address, not the person. Machines do not take a seat, so they are never priced as one.

  • €0.20 / GB

    Storage past what is included

    50 GB is included with every name, and past it the price is twenty cents a gigabyte.

A platform provisioning mail at its customers' domains pays both meters: a name per customer domain, and the mailboxes under it. The export is not on this list and never will be — charging for the way out would make it a lock.

50 GB

included with every name, before the third number applies

Where it runs

Mail infrastructure has one region at launch: eu-north-1, operated from Göteborg, with mailbox content and delivery records resident in the EU. This website's forms, functions and Firestore storage currently run in Google Cloud us-central1 in the United States. Full EU-only residency remains gated on migrating that infrastructure.

06 · What is not here

Mail arrives where you already work.

Ruzayo is the layer under a mail client, not the client. Arriving mail is routed — copied, forwarded, posted to a webhook, or held — so it lands in the systems you already run. Nothing here reads a message body, and nothing here is going to.

Four protocols below are not listening on this deployment today. Two more are not on the way at all, and saying which is which is the whole point of this section.

  • Standards before anything of our own invention.
  • Planned means not yet listening, and nothing more.
  • Refused means no condition brings it back.
Join the research registry
  • A mail client of our own Not something we will build. We are the layer under the client, and reading a message body is on the never-list — not for features, not for models, not once. refused
  • JMAP Not yet listening. The newer protocol, for clients that prefer it. not listening
  • SMTP submission Not yet listening. Sending from a client on port 587 rather than through the API. not listening
  • CalDAV Not yet listening. Calendars on the same name as the mail. not listening
  • CardDAV Not yet listening. Contacts on the same name as the mail. not listening

07 · The exit

Six things we will never do.

Custody you cannot leave is not custody. These have no condition attached, no milestone that brings them back and no customer size that buys an exception. They are the sentences to hold us to.

  1. 01

    Guarantee the inbox.

    Nobody can promise the inbox. We promise alignment, hygiene, watchfulness — and the evidence. Any service that says otherwise is describing its own queue and calling it yours.

  2. 02

    Charge for the export.

    Free, self-service, no ticket and no conversation. Charging for the door would make it a lock, and whatever the exit costs us to build it is never a line on your invoice.

  3. 03

    Read a message body.

    Not for features, not for models, not for support, not once. Support access is headers only, 60 minutes, approved by you and written into your own record where you read it.

  4. 04

    Price a machine as a seat.

    The unit is the address. An agent fleet is not a headcount, and pricing it like one is a way of charging for growth you did not ask us to help with.

  5. 05

    Sell bulk mailboxes for outreach.

    This is why a person reviews every name before it goes under service. A refusal names the signals it matched, and if we have it wrong, one reply fixes it.

  6. 06

    Cite a number we do not have.

    No customers, no testimonials, no uptime figure. There is no operating history to measure yet, and a number without a history behind it is decoration.

What leaving looks like

One .tar.gz per name, one maildir per mailbox, plus MANIFEST.sha256 — readable by any mail client without us, which is the whole point of the promise. Self-service export is not built yet; until it is, this is a commitment rather than a button.

Instead of an uptime figure

Every incident gets a postmortem within 48 hours, published in public, with the duration and the messages delayed. There is no private option. When we break that commitment, we break it where you can see it.

Every subprocessor is named on the privacy page, and it is named there before it holds anything.Read the privacy page

08 · The docket

Tell us whose name the mail will carry.

A person reads this. The published target is one business day, and a name is never admitted by software alone. We answer with what fits, what does not, and one scoped next step.

  1. 01Which name carries the mail?
  2. 02What is sending, and to whom?
  3. 03Roughly what volume, at the start?
  4. 04Who can suspend it?

This goes to a mailbox we run, which is a reasonable first test of the thing you are asking about.

Intake Required fields marked *

Used to answer you, and for nothing else.

09 · Research registry

Shape the second door.

This registry is for the surfaces in section 06. We write when there is something real to try, and not before — there is no queue position, no countdown and no launch date to miss.

Not an offer

Nothing on this page can be bought today. The meter in section 05 is the published one and it does not move with volume, so registering costs you nothing and buys you nothing. Register on the team track if that is the shape you would be testing.