MAILRAFT / PRODUCT

Email providers we support

MailRaft is deliberately provider-agnostic. The product runs on top of multiple email providers so your mailbox choice does not lock you into our pipeline, and our pipeline does not lock you into a single mailbox.

Overview

MailRaft talks to providers in two distinct roles. Inbound: the provider gives us messages your tenant receives (readonly). Outbound: the provider accepts and delivers approved messages your tenant sends. The two roles can be the same provider or different providers.

Amazon SES (outbound default)

• Verified identity: notify.mailraft.com in eu-north-1.
• Custom MAIL FROM: bounce.notify.mailraft.com with regional feedback-smtp MX.
• Configuration set: my-first-configuration-set.
• Feedback topic: arn:aws:sns:eu-north-1:…:mailraft-ses-events, consumed by https://api.mailraft.com/webhooks/ses.
• Current status: identity verified, sandbox pending production access.

Google Workspace (inbound readonly)

• OAuth scope: Gmail readonly.
• Deployed callback: https://app.mailraft.com/api/integrations/google/callback.
• Encrypted refresh tokens; one-use tenant/user state with PKCE.
• No Gmail send or modify scope requested.
• Current status: verified; owner Workspace consent, read, refresh and disconnect acceptance tracked separately.

Microsoft 365 (roadmap, parallel to Gmail)

• OAuth scope: Mail.Read.
• Deployed callback: planned at https://app.mailraft.com/api/integrations/microsoft/callback.
• Encrypted refresh tokens; one-use tenant/user state with PKCE.
• Scope progression (Mail.ReadWrite, Mail.Send) requires per-step owner ADR.
• Current status: roadmap; parallel lane with Gmail.

Yahoo Mail (roadmap)

• Primary path: Yahoo OAuth once a verified application is registered.
• Fallback path: app-password IMAP/SMTP under per-tenant scoped credentials.
• Current status: roadmap; depends on Gmail or Microsoft pilot evidence.

Generic IMAP/SMTP (roadmap)

• Per-tenant scoped IMAP read for inbound.
• Per-tenant scoped submission SMTP for outbound.
• STARTTLS and implicit TLS; strict certificate validation.
• Suppression and approval gates apply before any provider call.
• Current status: roadmap; shared mailbox-adapter contract after Yahoo.

Why multiple providers

• Deliverability resilience: a disruption at one provider does not stop the business.
• Compliance flexibility: regulated tenants choose providers in their region.
• Owner choice: SMB and enterprise tenants bring the mailbox their team already uses.

Shared contract across providers

• Readonly inbound by default; writes require per-step owner ADR.
• Approval gates apply equally regardless of provider.
• Suppression is enforced before any provider call.
• Credentials are encrypted at rest; disconnect clears local credentials first.

Non-goals

• MailRaft does not operate a mail server itself.
• MailRaft does not relay bulk marketing.
• MailRaft does not substitute for your mail provider spam, phishing and malware controls.