Inbound mail

Werkmail can receive mail for a tenant. Receiving is opt-in and always uses a dedicated subdomain.

MX rule (non-negotiable)

Publish inbound MX only on in.<your-sending-domain>.

Never point the apex MX at Werkmail. Apex MX would capture every message for the domain, including the owner’s personal and office inboxes.

If your sending domain is praxis.example, people write to hello@in.praxis.example (or whatever local-part you choose). The dashboard Inbox lists those messages.

Enable receiving

curl -sS -H "Authorization: Bearer $TOKEN" \
  "$BASE/api/practices/$PRACTICE_ID/inbound"

curl -sS -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" -d '{}' \
  "$BASE/api/practices/$PRACTICE_ID/inbound/enable"

Then publish the MX/TXT pair from GET …/dns-records (inbound section) or POST …/inbound/apply-dns when Cloudflare apply is enabled.

POST …/inbound/check — verify public DNS
POST …/inbound/disable
PATCH …/inbound — mailbox options
GET …/inbound/messages and GET …/inbound/messages/{messageID}

Inbound send hook

Automation tools can send as the tenant without a dashboard session. Create a hook; the secret (hooksec_…) is shown once.

curl -sS -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Automation"}' \
  "$BASE/api/practices/$PRACTICE_ID/inbound-hooks"

Public send (no session token):

curl -sS -X POST "$BASE/api/public/hooks/$PRACTICE_ID/send" \
  -H "Content-Type: application/json" \
  -H "X-Werkmail-Hook-Secret: $HOOK_SECRET" \
  -d '{
    "to": "you@example.com",
    "subject": "Hi",
    "text": "hello",
    "message_kind": "termin"
  }'

Rotate with POST …/inbound-hooks/{id}/rotate. Test with POST …/inbound-hooks/{id}/test.

The hook still runs the full send pipeline (suppressions, content gate, unsubscribe headers).

Abuse mailbox

Reports also land at abuse@werkmail.eu (and the inbound host on the brand). Public form: https://werkmail.eu/abuse. See Compliance.