SMTP SERVICE

Swap four settings and send from your own IP

mailstein speaks plain SMTP. Point your app, framework, or CMS at our relay, drop in your credentials, and mail goes out immediately — no SDK, no rewrite, no code change. The same infrastructure that runs the REST API runs the SMTP endpoint, so your IP, warm-up, and suppression list are identical either way.

The only change is your connection string

DROP-IN RELAY

Host, port, user, pass — done

Anything that can send SMTP can send through mailstein: Rails Action Mailer, Laravel, Nodemailer, Django, WordPress, Postfix, a cron job piping to sendmail, or an appliance that only knows how to talk to a mail server. Generate a credential in the dashboard, paste it into your existing mailer config, and you are sending on the same reputation as your API traffic.

No adapter to install, no library version to pin. If it worked against your old SMTP provider, it works against mailstein.

# .env — point your existing mailer here SMTP_HOST=smtp.mailstein.com SMTP_PORT=587 SMTP_USER=your-domain.com SMTP_PASS=ms_live_9f2c… # from the dashboard SMTP_SECURE=starttls # TLS required SMTP_FROM=hello@your-domain.com

Ports and TLS, the way you already expect them

Encrypted in transit on every port. Pick whichever one your platform or firewall is happiest with — the mail path behind them is the same.

01 / STARTTLS

Port 587

The default submission port. Connect plaintext, upgrade to TLS with STARTTLS before authenticating. The right choice for almost every app and framework, and the one most hosts leave open outbound.

02 / IMPLICIT TLS

Port 465

TLS from the first byte. Use it when your client library prefers implicit SSL or your security policy forbids any plaintext handshake. Same credentials, same endpoint.

03 / FALLBACK

Port 2525

Identical to 587 with STARTTLS, on an alternate port for networks and cloud providers that block outbound 25 and 587. When a PaaS firewall gets in the way, 2525 gets you out.

Credentials you can actually manage

SCOPED KEYS

Per-domain, revocable credentials

Each SMTP credential is tied to a sending domain and shown once. Rotate it, scope it to one app, or revoke it the moment a server is decommissioned — without touching the mail your other services are sending.

A leaked key on a staging box? Revoke that one credential. Production keeps sending, uninterrupted.
AUTH + ENFORCED TLS

AUTH LOGIN / PLAIN over TLS only

Standard SMTP auth that every mailer already supports, but mailstein refuses to accept credentials over an unencrypted channel. There is no plaintext path off the box, so a misconfigured client fails loudly instead of leaking silently.

No accidental clear-text auth — the connection is TLS before your password is ever sent.

SMTP, without the deliverability homework

The relay is the easy part. Landing in the inbox is what mailstein owns — and it's identical whether you send over SMTP or the API.

01 / AUTH

SPF, DKIM & DMARC

Add your domain once and mailstein generates the DNS records and signs every message that leaves over SMTP. Your MAIL FROM and DKIM signature line up, so authentication passes without you hand-editing a zone file.

02 / REPUTATION

Your IP, managed warm-up

Mail sent through the relay goes out on the Postal MTA from your own dedicated IP, with warm-up handled for you. It is your reputation and your IP — not a shared SES pool wearing a different logo.

03 / HYGIENE

Bounce & complaint suppression

Hard bounces and complaints are captured and suppressed automatically, so SMTP sends respect the same suppression list as your broadcasts. Every message is logged with its delivery event, on your servers.

Change the host. Keep the code.

Free tier is 50 emails a month and one domain — no card required. Generate an SMTP credential, paste it in, and watch it land.

Start free