Configure Inbound Emails & Webhooks

Overview

Simply Send provides a comprehensive, developer-first solution to receive incoming emails. When an email is routed to your domain, Simply Send automatically:

Step 1: Set Up Inbound MX Records

Before Simply Send can process incoming mail for your domain, you must configure a Mail Exchanger (MX) record in your domain's DNS panel. This record authorizes Simply Send to receive messages on your domain (or a subdomain prefix).

Step 2: Connect Webhooks for Real-Time Event Routing

Once your Inbound DNS is verified, configure a Webhook endpoint to instantly forward received emails to your own server backend.

Webhook Event Payload Structure

When an email is received, Simply Send sends an HTTP POST request containing a structured JSON payload containing the sender, recipients, subject line, body summary text, and attachment metadata.

{
  "id": "evt_1726513462888_0a3b2c1d",
  "type": "email_received",
  "created": "2026-06-22T21:45:12.118Z",
  "data": {
    "messageId": "[email protected]",
    "recipient": "support@mail.yourdomain.com",
    "timestamp": 1782183912118,
    "metadata": {
      "subject": "Inquiry regarding billing",
      "from": "[email protected]",
      "to": "support@mail.yourdomain.com",
      "snippet": "Hello support, I have a quick question about my invoice #1234...",
      "hasAttachments": true
    }
  }
}

Webhook Security & Signature Verification

Simply Send adds cryptographic signatures to prevent tampering and spoofing. Every webhook post includes a signature in the X-Webhook-Signature header.

To verify the signature, compute an HMAC-SHA256 hash using your webhook's **Signing Secret** and the raw JSON request body, then compare it to the received header value.

const crypto = require('crypto');
const express = require('express');
const app = express();

// Webhook endpoint (Requires raw body to compute signature)
app.post('/webhooks/simply-send', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const payloadString = req.body.toString('utf8');
  const secret = process.env.SIMPLY_SEND_WEBHOOK_SECRET;

  if (!signature) {
    return res.status(401).send('Missing signature header');
  }

  // Calculate the expected HMAC-SHA256 signature
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payloadString)
    .digest('hex');

  if (crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expectedSignature, 'hex'))) {
    // Webhook is authenticated and secure
    const event = JSON.parse(payloadString);
    console.log('Received event: ' + event.type);
    
    if (event.type === 'email_received') {
      const emailData = event.data.payload;
      console.log('Email from: ' + emailData.from + ', Subject: ' + emailData.subject);
    }

    return res.status(200).send({ received: true });
  } else {
    // Signature verification failed
    return res.status(403).send('Invalid signature');
  }
});

app.listen(3000, () => console.log('Listening for webhooks...'));

Credit Consumption & Cost

Inbound email processing consumes credits from your Simply Send account balance at the same rate as outbound sending. Credits are charged per recipient processed, depending on the usecase of your verified domain:

Retention and Attachment Storage