ScanMyPassKhat
Transactional email infrastructure
Email you actually own,not rented by the message.
Khat sends from your own verified domains, signs every message with that domain's own DKIM key, and tells you what the receiving server said. Your IP, your reputation, no per-message fee.
to=<customer@gmail.com> relay=gmail-smtp-in.l.google.com[142.250.31.26]:25
250 2.0.0 OK dkim=pass spf=pass dmarc=pass delay=0.9sOne message, end to end
01
Prove the domain is yours
Add a domain and publish four records. Verification names the exact failure — a duplicate SPF record, a DKIM key that does not match, a lookup that timed out — instead of just refusing.
02
Send over HTTP
One POST. The API validates, checks the domain and your quota, writes the row and queues the job. It never waits for SMTP, because remote delivery takes seconds to minutes and that is not your request's problem.
03
Read the reply, not a guess
Delivery is confirmed from the MTA's own log. Sent means our server accepted it; delivered means theirs did. Both are shown, because they are not the same claim.
04
Handle what comes back
Bounces are parsed to RFC 3464 and 5965, classified hard, soft or complaint, and hard failures are suppressed automatically. Replies arrive in an inbox you can read or receive by webhook.
Status in the language of the protocol
Mail state is not a set of invented labels. It maps onto SMTP reply classes, which is how anyone reading a log already thinks. Khat shows the class, so you can tell at a glance whether something is still being retried or gone for good.
- 2xxdelivered
- The recipient's server took it.
- 4xxdeferred
- Transient. Greylisting, a rate limit, a bad moment. Still retrying.
- 5xxbounced
- Permanent. The address is suppressed so you cannot mail it again.
- —queued
- Ours, not theirs. Nothing has been said on the wire yet.
Replies come back too
Turn receiving on for a domain, publish one MX record, and mail arrives in an inbox you can read — or as an email.received webhook. Attachments are kept, the original bytes are kept, and SPF, DKIM and DMARC results are reported for every message rather than filtered out of sight.
The default is a subdomain, not your apex — an MX record at the apex replaces wherever your mail currently goes, and that should never be a side effect of ticking a box.
What this will not do for you
Running your own mail server trades a per-message fee for work you now own. It is worth knowing which work before you start.
Reputation takes weeks
A new IP has none, and providers treat it accordingly. Volume ramps over two to three weeks. A shared pool like SES is warm on day one; that is the real thing you give up.
Port 25 must be open
Most hosts block outbound 25 by default and Google Cloud never unblocks it. You also need to be able to set reverse DNS on the sending IP.
The Gmail avatar is not ours to give
The logo beside a sender name is BIMI. It needs a trademark and a Verified Mark Certificate that costs four figures a year. Khat generates the record; it cannot make the certificate free.
Send your first message
Add a domain, publish four records, create a key. The docs are open — read them first if you prefer.