The mail plane your agents operate
Mail your product sends,
and your agents can run.
Mailstack is one system for sending, receiving, campaigns and automation — with the guardrails built into the schema, not a prompt. Give a teammate or an AI agent a mailbox that cannot email the wrong people, oversend, or leak across brands.
Invite-only early access · no card required
AI product builders
Your support or SDR agent needs a real mailbox — send, thread, reply — without an OAuth scope into someone's Gmail and without hoping the model won't mail four thousand people.
Multi-brand operators
Agencies, holdcos, portfolios. One console, one account, many brands — with transactional and outreach reputations kept structurally apart.
Teams who live on deliverability
When a domain's inbox placement is the business, you want suppression that's global and one-way, authentication that passes, and sending that stops itself before it hurts you.
Everything the mail runs on, in one place
A working mail server, an inbox, a campaign engine and an automation layer — not four vendors stitched together.
Sending
Templated, authenticated mail with SPF, DKIM and DMARC that pass, and one-click unsubscribe on everything that needs it.
Inbox & threading
Real receiving: threads, attachments, cross-folder search, and replies that join back to the message that provoked them.
Campaigns with planes
Paced outreach that keeps its position across days — and structurally cannot send from the domain your receipts use.
Signed links
Password resets, verifications and claimable accounts, where the link's purpose is inside its signature.
Scheduling
Cron-driven jobs you can add, pause and inspect — batches, reply polling, health checks — no server edits.
Agent-ready API
One key scopes every call to one account. The limits a model can read are the limits it actually has.
The guardrails are structural, not a prompt
Every assistant sitting on top of a mailbox enforces its rules in a system prompt a model can be talked out of. Mailstack puts them where a prompt cannot reach.
An agent can email you, and no one else, unattended.
The notify function takes no recipient. A stranger is not a value it can be given.
Outreach and transactional never share a reputation.
A campaign cannot select a transactional domain. Enforced at send, not by convention.
Suppression is global and one-way.
One opt-out silences every campaign forever. There is no un-suppress to call by mistake.
A leaked database leaks no live session.
Sessions are rows you can revoke; the cookie is only a pointer to one.