Send from your own domain, authenticated with your own DKIM key. We generate the DNS records, you publish them, and we refuse to send a single message until they verify.
$5 a month, in early access — the price is set, the billing is not built yet, so nobody is charged for it today.
Every provider that survives does this, and it is not a convention — it is how SPF, DKIM and DMARC are actually checked.
If the From address says your brand and the authentication says ours, DMARC alignment fails and the mail goes to spam. Your domain has to authenticate as itself.
Your DKIM key is generated for your domain and used for nothing else. A shared key means one customer's compromise forces a rotation for everybody.
Only the domain's owner can add those records. That is exactly what makes verification proof of control rather than a formality.
One API call. We generate a 2048-bit DKIM key for your domain and return the three records to publish.
curl -X POST https://tunnelnet.io/v1/mail/domains \ -d '{"email":"you@example.com","domain":"example.com"}'
SPF, DKIM and DMARC, in your own DNS. We tell you exactly what each one is for and what breaks if it is wrong — a value split across two lines by a DNS panel is the most common failure and we name it specifically.
We check what is actually published from multiple independent resolvers. If they disagree we say not visible yet rather than telling you your DNS is wrong — DNS caches for several minutes and a verifier that blames you for that is worse than useless.
curl -X POST https://tunnelnet.io/v1/mail/domains/example.com/verify → {"verified": true} — sending enabled
Your mail leaves signed with your key, from an IP with correct forward-confirmed reverse DNS that is on no blocklist we can find.
No provider can promise your mail reaches the inbox rather than the spam folder — placement is the receiver's decision and it is not observable from the sending side. What we can do is make every check that receivers actually run come back clean, and record what happened to each message so "sent" and "delivered" never quietly become the same word.
What is live today, stated plainly, because a service page that overstates itself is the first broken promise.
Domain signup, DNS record generation, verification, per-domain DKIM signing, and sending. Proven end to end on a domain that had no mail records at all.
This is new. It works and it is small. If you want a domain on it, get in touch and we will set it up with you rather than leave you alone with an API.
Bounce and complaint handling, and a dashboard. Both are being worked on; neither is pretended to exist.