# Inbound mail

Werkmail can receive mail for a tenant. Receiving is **opt-in** and always uses a dedicated subdomain.

## MX rule (non-negotiable)

Publish inbound MX **only** on `in.<your-sending-domain>`.

Never point the **apex** MX at Werkmail. Apex MX would capture every message for the domain, including the owner’s personal and office inboxes.

If your sending domain is `praxis.example`, people write to `hello@in.praxis.example` (or whatever local-part you choose). The dashboard Inbox lists those messages.

## Enable receiving

```bash
curl -sS -H "Authorization: Bearer $TOKEN" \
  "$BASE/api/practices/$PRACTICE_ID/inbound"

curl -sS -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" -d '{}' \
  "$BASE/api/practices/$PRACTICE_ID/inbound/enable"
```

Then publish the MX/TXT pair from `GET …/dns-records` (inbound section) or `POST …/inbound/apply-dns` when Cloudflare apply is enabled.

Related:

- `POST …/inbound/check` — verify public DNS
- `POST …/inbound/disable`
- `PATCH …/inbound` — mailbox options
- `GET …/inbound/messages` and `GET …/inbound/messages/{messageID}`

## Inbound send hook

Automation tools can send **as the tenant** without a dashboard session. Create a hook; the secret (`hooksec_…`) is shown once.

```bash
curl -sS -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Automation"}' \
  "$BASE/api/practices/$PRACTICE_ID/inbound-hooks"
```

Public send (no session token):

```bash
curl -sS -X POST "$BASE/api/public/hooks/$PRACTICE_ID/send" \
  -H "Content-Type: application/json" \
  -H "X-Werkmail-Hook-Secret: $HOOK_SECRET" \
  -d '{
    "to": "you@example.com",
    "subject": "Hi",
    "text": "hello",
    "message_kind": "termin"
  }'
```

Rotate with `POST …/inbound-hooks/{id}/rotate`. Test with `POST …/inbound-hooks/{id}/test`.

The hook still runs the full send pipeline (suppressions, content gate, unsubscribe headers).

## Abuse mailbox

Reports also land at `abuse@werkmail.eu` (and the inbound host on the brand). Public form: [https://werkmail.eu/abuse](https://werkmail.eu/abuse). See [Compliance](/compliance).