---
title: "Self hosted transactional email on your own domains"
description: "Mailwright is self hosted transactional email for your own domains. As of July 2026, eight domains scored 10/10 on mail-tester with SPF, DKIM and DMARC."
canonical: "https://laboetie.io/products/mailwright"
language: en
---
# Mailwright: self hosted transactional email

Mailwright is a self hosted transactional email platform that sends and receives on your own domains. Our team runs the stack, onboards each domain and handles deliverability. As of July 2026, eight domains scored 10/10 on mail-tester with SPF, DKIM and DMARC aligned. The platform targets volumes under 10,000 emails a month.

Status: Live. Access: By request. As of July 2026, eight domains onboarded at 10/10 on mail-tester with SPF, DKIM and DMARC aligned.

## Capabilities

- A compatible API covers the endpoints of a hosted provider, so a project can migrate with a base URL swap, and a native API sits alongside it.
- Outbound mail is paced to protect your reputation.
- Before sending, the Mailwright gateway rejects typo domains and domains with no MX.
- Complaint handling sits beside consent proof, which archives the exact wording shown.
- Inbound mail is filtered against brand impersonation.

## The open source stack behind Mailwright

Mailwright is built on four open source projects. They are Postal for delivery, Listmonk for lists and campaigns, rspamd for inbound filtering and dmarc-srg for DMARC reports. We built the gateway and the deliverability layer on top of them. Our team operates this stack and onboards every domain.

## Who handles deliverability

Mailwright handles deliverability at three points. Before sending, the gateway refuses typo domains and domains with no MX record. During sending, it paces outbound mail. After sending, complaint reports add the complaining address to the suppression list.

## SPF, DKIM and DMARC on every domain

Our team sets up the SPF, DKIM and DMARC records of each domain during onboarding. As of July 2026, eight domains were fully onboarded at 10/10 on mail-tester with all three aligned. That figure is dated and does not count later domains.

## Receiving email on your own domain

Inbound mail reaches your application as a parsed message posted to the endpoint you set. Mailwright scores each message with rspamd first. A filter catches display names that impersonate brands. Each delivery to your endpoint is signed.

## Migrating from a hosted email provider

Mailwright offers a compatible API for migration and a native API beside it. The compatible API covers the hosted provider endpoints our client projects used, so a project on those endpoints moves by changing the base URL and the API key. Check your calls against that list before you plan a switch.

## Consent proof and complaint reports

Mailwright archives the exact consent wording shown to each contact. Each wording version is stored once under its hash. Every consent event points to its version, which preserves the proof after a later change to the form. Complaint reports arrive in the standard feedback format and add the address to the suppression list.


## What self hosted transactional email means

**Transactional email** is the mail your application sends one person at a time because of something that person did: a password reset, an order confirmation, an alert, a login link. Marketing email goes to a list in one campaign. The two need different handling, since a password reset must arrive within moments.

**Self hosted** means the servers that send those messages belong to you or to an operator you chose, in place of a hosted email API. You gain control over data, reputation and cost. You also take on what a hosted provider handled: DNS, IP reputation, bounces, complaints and blocklists.

Mailwright is a managed version of that choice. It runs on open source software, sends from your domains, and our team operates the platform and onboards each domain.

## Hosted provider, raw self hosting or Mailwright

| Question | Hosted email API | Self hosting alone | Mailwright |
|---|---|---|---|
| Who runs the servers? | The vendor | You | Our team |
| Who handles deliverability? | Mostly the vendor | You | Our team, with your DNS access |
| Who holds message data? | The vendor | You | The platform we run for you |
| Pricing logic | Usually per email or by tier | Server cost and your time | Quoted per engagement |
| Sends above 10,000 a month | Normal use | Depends on your setup | Outside the current target |
| Inbound mail | Often an add on | You build it | Included |

For large volume, a hosted provider is the sensible choice. Mailwright fits businesses with moderate volume that want their mail on infrastructure they can inspect and leave.

## The stack

Mailwright is built on four open source projects: Postal for delivery, Listmonk for lists and campaigns, rspamd for inbound filtering and dmarc-srg for DMARC reports. Credit goes to them. Our own work is the layer around them that handles deliverability, consent and events. Each tenant has its own keys and its own suppression list.

## Send an email

The native API takes a JSON request.

A second API follows the endpoints of a hosted provider our client projects used. A project on those endpoints moves by changing its base URL and its key.

Sends can be scheduled, and a scheduled send can be cancelled before it leaves.

## SPF, DKIM and DMARC

Three DNS records prove that a message comes from your domain.

| Record | What it proves | Where it lives |
|---|---|---|
| SPF | Which servers may send for the domain | A TXT record |
| DKIM | The domain signed the message, and nobody altered it | A TXT record holding a public key |
| DMARC | What receivers should do when the two checks fail, and where to send reports | A TXT record at `_dmarc` |

Large mailbox providers now require authentication, and alignment means the domain in these checks matches the visible From address. A DMARC policy usually starts at `none`, moves to `quarantine`, then reaches `reject` once reports show that all your legitimate mail passes.

We recommend a sending subdomain such as `mail.example.com`. Your root domain and its human mailboxes stay untouched, and a reputation problem stays contained to the subdomain.

## Onboarding a domain

1. We create the tenant and print the DNS records.
2. You or your DNS provider apply them.
3. We check the records against the authoritative nameserver.
4. We send a test and read the signature on a real message.
5. We enrol the domain with the mailbox provider tools that accept it.
6. We switch your application over.

As of 12 July 2026, eight domains were fully onboarded at 10/10 on mail-tester, with SPF, DKIM and DMARC aligned. That figure is dated, and later domains are not included in it. A mail-tester score covers configuration on one test message. Inbox placement also depends on your content and your recipients.

## Deliverability controls

**Deliverability** is the share of your mail that reaches the inbox. Mailwright works on it at three points.

| Moment | Control | Why it matters |
|---|---|---|
| Before sending | Refuses typo domains such as `gmial.com`, disposable domains and domains with no MX record | A hard bounce hurts your reputation |
| Before sending | Checks the tenant suppression list | Repeat sends to a bad address get worse each time |
| During sending | Paces outbound mail | Mailbox providers slow or refuse sudden bursts |
| During sending | Optional daily cap per tenant | Contains a bug that loops on sends |
| After sending | Reads complaint reports and adds the address to suppressions | Complaints weigh heavily on reputation |
| After sending | Reads DMARC reports per domain | Shows who sends as you |

**Warm up** means raising volume gradually on a new IP or domain so providers can observe good behaviour. Moderate transactional traffic warms up on its own. A large first campaign to an old list is the classic way to ruin a new domain, so it needs a plan.

## Bounces and suppressions

| Event | Meaning | What happens |
|---|---|---|
| Hard bounce | The address does not exist | The address joins the suppression list |
| Soft bounce | Temporary problem, such as a full mailbox | Postal retries |
| Complaint | The recipient pressed the spam button | The address joins the suppression list |
| Unsubscribe | The person left a list | Synced between Listmonk and the platform |

Suppressions apply per tenant, and they sync with Listmonk, so a person who complains about a receipt does not get next week's newsletter.

## Signed webhooks

Your application receives events through webhooks. Each request carries an event id, a timestamp and a signature, so your code can confirm where it came from and ignore a duplicate. When your handler fails, the event is sent again.

## Receiving email

Mailwright receives on your domains as well. Each inbound message is scored, and a filter catches display names that impersonate known brands, such as a sender calling itself your bank from an unrelated domain. A clean message reaches your endpoint as signed JSON.

| Use | Setup |
|---|---|
| A support inbox inside your app | Point the MX at the platform |
| Replies to notifications | A dedicated reply subdomain |
| Outbound only | Leave your MX where it is |

Human mailboxes are out of scope. Mailwright is a sending and receiving platform for applications, and a team that uses a webmail keeps its existing provider on the root domain.

## Consent proof

GDPR asks you to demonstrate consent. An IP address and a date prove little if nobody can show what the person agreed to. Mailwright archives the exact wording, and every consent event points at the version the person saw.

| Stored | Example |
|---|---|
| Event type | Form submitted, opt in confirmed, withdrawn |
| Time and IP | When and from where |
| Wording version | The text shown on the form that day |
| List and scope | What the person agreed to receive |

The log only grows, so a later change to the form leaves the proof intact. This helps you meet your duties, and you remain the data controller.

## Migrating from a hosted provider

1. List the endpoints, events and templates your projects use.
2. Compare them with the compatible API.
3. Create the tenant and publish the DNS records on a subdomain.
4. Move one low risk flow first, such as a notification.
5. Watch events, bounces and inbox placement.
6. Move the remaining flows, then import suppressions and consents.
7. Keep the old account open during the transition.

Keeping the old account lets you roll back by restoring one environment variable.

## Next step

[Send a brief](https://laboetie.io/brief) with your domains, your monthly volume and your current provider. The studio will reply with a migration plan. [SocialForge](https://laboetie.io/products/socialforge) and other products of the studio already send through it.


## Frequently asked questions

### What is self hosted transactional email?

With self hosted transactional email, order confirmations, password resets and alerts leave from mail servers an operator runs itself. Those servers send from your own domains. Mailwright provides that platform on open source Postal, and our team operates it. Your application calls an API to send, and the platform handles delivery, suppression and complaints.

### Do I have to manage deliverability myself when self hosting?

Not on Mailwright. A self hosted sender usually owns SPF, DKIM, DMARC and reputation alone. Our team onboards each domain. The gateway rejects typo domains and domains with no MX record. Outbound mail is paced. Our July 2026 reading showed eight domains at 10/10 on mail-tester with all three records aligned.

### Can I set up Mailwright myself?

No. Our team onboards each domain because Mailwright has no self serve path today. Access is by request: you send a brief that names the domains to onboard, and we set up the tenant and its sending records. That onboarding covers the SPF, DKIM and DMARC records of each domain before the first send.

### What volume can Mailwright send?

Mailwright targets volumes under 10,000 emails a month. Outbound pacing runs per connection under an optional daily cap per tenant. We make no high volume claim for this platform. If your sends run above that level, state the figure in your brief so we can tell you whether Mailwright fits.

### Does Mailwright receive email?

Yes. Mailwright handles both directions on your domains. Inbound mail goes through rspamd, then the platform posts the parsed message to the endpoint you set. A filter on display names catches messages that impersonate brands. Campaigns and lists run on open source Listmonk within the same platform.

### How do I migrate to self hosted email?

Start with your API calls. Mailwright has a compatible API that covers the hosted provider endpoints our client projects used, so a project on those endpoints moves by changing the base URL and the API key. A project outside that list moves to the native API. Each domain goes through onboarding before the first send.

### How does Mailwright keep proof of consent?

Mailwright archives the exact wording shown to the contact. Each version of that wording is stored once under its SHA-256 hash. Every consent event points to its version, which preserves the proof after a later change to the form. The event records the email, the channel and the date. This page describes platform behavior and gives no legal opinion.