Request early accessRequest accessEarly access

Send · Deliverability

The parts of email nobody sees, done carefully.

Authentication, suppression, unsubscribe handling and an automatic bulk pause are built into every send. This is exactly what happens to each message.

Request early accessRead the quickstart
Domains · nimbu.exampleSample data
The records a sending domain publishes, and their status. Illustrative values: your dashboard shows your own.

01, Authentication

Your domain, authenticated.

Every message is DKIM-signed with your domain’s own key, and bounces come back through a return-path subdomain, so SPF lines up with your From address too.

  • A 2048-bit DKIM key is generated for each domain. The private half is encrypted at rest and never leaves us.
  • SPF lives on a return-path subdomain such as bounce.nimbu.example, so the SPF record on your root domain stays as it is.
  • The setup wizard suggests a DMARC record to start with: p=none, with reports sent to you.
  • New records are checked automatically, first after a minute and then less often, for 72 hours. Verified domains are re-checked daily, and a missing DKIM record fires domain.updated.
What the receiving server checksHTTP
Return-Path: <…@bounce.nimbu.example>
DKIM-Signature: v=1; a=rsa-sha256; d=nimbu.example; s=rfk3m7q2xa; …
From: Nimbu <[email protected]>
To: [email protected]
Subject: Order #1042 is confirmed

02, Unsubscribe

Unsubscribe that works the way mailbox providers require.

Bulk mail carries List-Unsubscribe and List-Unsubscribe-Post, so the big mailbox providers can show their own unsubscribe button and honour it in one click. Transactional mail doesn’t carry them: a login code isn’t something to unsubscribe from.

  • Opening an unsubscribe link, a GET, shows a page and never unsubscribes anyone. Link scanners that open every URL can’t opt your readers out. Only the POST does.
  • The one-click POST from the mailbox’s own button needs no page at all, as RFC 8058 describes.
  • An unsubscribe stops marketing mail only. Receipts and login codes still arrive.
  • Every opt-out writes a row to the contact’s consent ledger: when, how, and from which email.
Read RFC 8058
A broadcast’s headersHTTP
Return-Path: <…@bounce.nimbu.example>
DKIM-Signature: v=1; a=rsa-sha256; d=nimbu.example; s=rfk3m7q2xa; …
From: Nimbu Books <[email protected]>
To: [email protected]
Subject: Early access: the festive collection
List-Unsubscribe: <https://t.nimbu.example/u/…>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

03, Suppression

One suppression list for both halves.

Hard bounces and complaints are suppressed for every future send: API, SMTP, broadcasts and automations alike. A suppressed address is skipped and reported, never attempted.

  • Each skipped recipient fires email.suppressed, saying whether an earlier bounce or a complaint put it there.
  • Soft bounces are counted, not ignored. Five in a row over at least a week, with no delivery in between, suppress the address.
  • A policy block (a 5.7.x reply) isn’t a bounce. The event is recorded and the address stays deliverable.
  • Taking a complaint off the list needs an owner or admin, or a full-access API key.
Events · todaySample data
A permanent bounce puts the address on the suppression list in the same minute, so the next send to it is skipped.

04, Auto-pause

One sender’s problem stays with that sender.

When an account’s complaint or hard-bounce rate over the last 7 days crosses the limit, its bulk sending pauses on its own.

  • Transactional mail keeps flowing while bulk is paused, and bulk sending resumes after an admin review. The limits are in the acceptable-use policy.
  • Each account and each agency client will send as its own tenant, with a sending reputation of its own, so one stale list cannot drag down anyone else’s.Coming
Reputation by tenant
Illustration of per-tenant isolation, which is coming: three client accounts, each with its own reputation. The bounce spike in one account stays in its own lane.

05, Fair queue

A slow campaign doesn’t hold up an OTP.

Transactional and bulk mail wait in separate lanes with their own send slots. Inside each lane, accounts take turns.

  • One account’s large campaign doesn’t delay another account’s campaign either: the bulk lane serves accounts in rotation.
  • Sending rates are enforced per account and per route out, so no single account can take the whole pipe.
Send queue
Illustration of the scheduling rule: two lanes, accounts taking turns. It shows order, not counts or timings.

06, Before sending

Checked before you hit send.

Before a broadcast goes out, its sending domain is checked against the bulk-sender rules the big mailbox providers publish: authentication that passes and aligns, a DMARC record, and one-click unsubscribe.

The broadcast itself is checked too: the unsubscribe link is added for you, and it won’t launch without your postal address. If a check fails, it stops with the reason on screen, before a single message is sent.

How broadcasts work
Broadcast · before launchSample data
The pre-send check on a broadcast.

07, Machine opens

Scanners aren’t readers.

Security scanners and privacy proxies open emails and follow links that no person saw. Those opens and clicks are marked as machine events and kept out of your unique open and click counts.

  • Privacy proxies that fetch every image on delivery, the link scanners in corporate mail filters, and clicks within 10 seconds of delivery are all flagged.
  • Webhooks still report them, with machine_open set, so you can count them your own way.
email.openedJSON
{
  "type": "email.opened",
  "created_at": "2026-09-22T04:32:09.114Z",
  "data": {
    "email_id": "01a0c762-aaf4-7269-9ef2-a74de452e6b4",
    "created_at": "2026-09-22T04:32:07.412Z",
    "from": "Nimbu <[email protected]>",
    "to": ["[email protected]"],
    "subject": "Order #1042 is confirmed",
    "machine_open": true
  }
}

08, Coming

Not yet, and labelled that way.

Two things we don’t have today. Each carries a Coming badge wherever it appears, until it ships.

  • Dedicated IPs with a warm-up planComing

    For senders who want their reputation on addresses of their own, warmed up gradually before full volume.

  • Postmaster-tools enrolment for your sending domainsComing

    Help registering your sending domains with the mailbox providers’ postmaster tools.

Verify your first domain.

Add the records we show you. We check them for you and tell you when they pass.

Request early accessRead the quickstart