Get started
Setup
From nothing to a delivered message. The only step that can make you wait is DNS, and everything before it takes minutes.
What you need first
A domain whose DNS you control. You cannot send as you@gmail.com — you cannot prove you own gmail.com, and its own DMARC policy would reject the mail. A subdomain of a domain you own is fine.
That is the whole list. Nothing to install, no server of your own to run.
Create an account
An email address and a password. No card, no sales call.
Your account starts with a low sending allowance. That is not a paywall — it is how a new sending reputation gets built without the IP being filtered, and it rises as your sending stays clean.
Add your domain
Domains → Add domain. Enter the domain you want mail to come from — example.com if you will send as hello@example.com.
A DKIM key pair is generated for that domain immediately. The private half is encrypted before it is stored and is only decrypted in memory at the moment a message is signed — it is never shown to anyone, including you.
Publish four DNS records
Go to whoever manages your domain's DNS and add these. The dashboard shows the exact values for your domain, each with a copy button.
| Type | Name | What it does | Required |
|---|---|---|---|
| TXT | @ | SPF — authorises our infrastructure to send for you | Yes |
| TXT | …_domainkey | DKIM — the public half of your signing key | Yes |
| TXT | _dmarc | DMARC — what receivers should do with mail that fails | Recommended |
| CNAME | bounce | Return path — puts the envelope sender on your domain | Recommended |
The two things that go wrong most
The name field is relative at most providers. Typing bounce.example.com where it wants bounce creates bounce.example.com.example.com, which silently does nothing. Type just the label.
A domain may publish only one SPF record. If you already have one — Google Workspace, another sending service — do not add a second. Merge our include: into the record you have. Two SPF records is a permanent error and fails authentication completely.
Verify
Verify DNS on the domain page. SPF and DKIM must both pass before the domain can send anything.
A failing check names what is actually wrong rather than just refusing — a duplicate SPF record, a DKIM key that does not match the one issued, a record on the wrong name, a lookup that timed out.
Verification reads your domain's own nameservers rather than a public resolver, so it sees your change as soon as your provider has made it instead of waiting for the internet's caches to expire.
Create an API key
API keys → Create. It is shown once and stored only as a hash, so copy it straight into an environment variable.
export MAIL_API_KEY='re_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'Keep it server-side. A key can send as any address on your verified domains, so it belongs in your backend — never in a browser bundle or a mobile app.
A key deliberately cannot create another key; that needs a dashboard login. So if one leaks, revoking it is enough — it could not have minted others.
Send
curl -X POST https://mail-api.scanmypass.com/v1/emails \
-H "Authorization: Bearer $MAIL_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"from": "hello@example.com",
"to": ["you@gmail.com"],
"subject": "First message",
"html": "<p>It works.</p>",
"text": "It works."
}'{
"id": "email_9f3k2m1x8b7c4d5e6a0z",
"status": "queued",
"createdAt": "2026-08-17T12:00:00.000Z"
}202 means queued, not delivered
Remote delivery takes seconds to minutes, and the API does not wait for it — that would make your request as slow as the slowest mail server on the internet. Watch the outcome on the Sent page, with GET /v1/emails/{id}, or by webhook.
Send both html and text. A message with only an HTML part is filtered harder. If you write HTML, include a plain-text version of the same content.
What to watch while you ramp
There is no per-message charge, so there is no meter. There is an allowance, counted per recipient — a message to fifty people spends fifty, not one.
It exists for one reason: an IP with no sending history gets filtered if it suddenly sends thousands of messages, and no amount of correct DNS prevents that. Volume that ramps over two to three weeks lands. Volume that spikes does not.
| Metric | Keep it | Trouble at |
|---|---|---|
| Bounce rate | under 2% | over 5% |
| Complaint rate | under 0.1% | over 0.3% |
| Delivery rate | over 95% | under 90% |
If bounce rate climbs, stop increasing volume and clean the list first. Mailing addresses that do not exist is the fastest way to lose a reputation you spent weeks building. The Deliverability page tracks all three.
It passed everything and still went to spam
Authentication and reputation are different things. Passing SPF, DKIM and DMARC proves you are not forged; it does not make you trusted. A new sender is treated with suspicion for a few weeks regardless.
- Mark your own test messages “not spam”, and reply to them — engagement is the strongest signal you can give.
- Keep volume low and consistent rather than sending in bursts.
- Register the domain with Google Postmaster Tools on day one. It reports what Gmail actually thinks of you rather than what you hope.
The logo beside the sender name in Gmail
That is BIMI, and it is not something a sending service can switch on. It needs DMARC at p=quarantine or p=reject, a registered trademark, and a Verified Mark Certificate costing four figures a year. The logo you set under Branding appears inside the message body — a different thing, and it works everywhere today.