Email glossary for transactional email

A secret string that identifies your account when your code calls an API. Treat it like a password: keep it out of client-side code and public repositories.

In tinyRelay: Sent in the X-RELAY-ACCESS-TOKEN header on every request, which must also come from IP addresses we have allowlisted for you. Your key is issued during onboarding.

A file carried inside an email, such as a PDF invoice, encoded as a separate part of the message. Some receiving servers reject messages because of attachments.

In tinyRelay: Attachment support isn't covered in the tinyRelay docs, so ask our team. Bounce category 53, Attachment detected, means a receiving server refused a message because of its attachments.

Brand Indicators for Message Identification: an emerging email specification that lets supporting mailbox providers show a brand's logo next to its messages, but only when the message passes DMARC.

In tinyRelay: BIMI support is not confirmed for tinyRelay; ask our team. Publishing DMARC is the first step either way.

A message the receiving server did not deliver and reported back as failed. Bounces are hard (permanent) or soft (temporary).

In tinyRelay: A bounce arrives as a BOUNCED webhook event with a subType of HARD_BOUNCED or SOFT_BOUNCED, a bounceCategory, and the server's own bounceDescription and bounceStatus.

A numeric code that says why a message bounced, so software can decide whether to retry, investigate or stop sending.

In tinyRelay: There are 19 documented categories, from 10 (bad email address) to 55 (SPF/DKIM/DMARC) to 60 (auto-reply). They come down to four answers: stop sending, retry later, investigate, or keep sending.

Rewriting the links in an email so each click passes through the sender's tracking server, which records it, before reaching the destination.

In tinyRelay: Open and click tracking are on by default. Every CLICK event carries the exact url clicked. disableTrackingLinks: true turns tracking off for a whole request.

A DNS record that makes one name an alias of another. Services use it so you can point a name on your domain at a record they manage.

In tinyRelay: DKIM is set up with one CNAME: tec1._domainkey.yourdomain pointing to tec1.dkim.tinyemail.com.

DomainKeys Identified Mail (RFC 6376): a cryptographic signature that lets a domain take responsibility for a message and lets receivers check it was not changed in transit. The public key is published in DNS.

In tinyRelay: Your mail is DKIM-signed once you add the tec1._domainkey CNAME. PUT /domain/dns/check reports whether DKIM is Valid.

Domain-based Message Authentication, Reporting and Conformance (RFC 7489): a DNS policy that checks SPF or DKIM passed for a domain aligned with the From address, and tells receivers what to do if not: none, quarantine or reject.

In tinyRelay: DMARC is a TXT record you publish at _dmarc on your own domain. The free checker reads it alongside SPF and DKIM.

The Domain Name System: the internet's directory that maps names to records such as addresses, mail servers and text policies. Email authentication lives in DNS.

In tinyRelay: You add records for each sending domain during onboarding, and PUT /domain/dns/check validates DKIM and SPF and returns the records it expects.

Something that happens to an email after you send it, such as delivery, a bounce, an open or a click, reported back to the sender.

In tinyRelay: Seven event types: SEND, DELIVERED, BOUNCED, OPEN, CLICK, UNSUBSCRIBE and SPAM. Each carries eventTime, requestTime and your metadata.

A permanent delivery failure, such as a mailbox that does not exist. Sending to the address again will not work.

In tinyRelay: BOUNCED events with subType HARD_BOUNCED: categories 10 (bad email address) and 90 (unsubscribe). The docs say to add these addresses to your own suppression list.

Accepting requests only from a known list of IP addresses. It narrows who can reach a system, but on its own it is not authentication.

In tinyRelay: The IP addresses you call the API from are allowlisted at setup. Webhooks come from 3.229.12.181, and you should still verify their signatures.

Hiding a tracked link's destination inside an opaque token, so the real URL is not readable in the message.

In tinyRelay: Send the header X-Link-Wrapping: true and tracked links carry a tamper-proof token instead of a readable redirectUrl. It is off unless you send the header.

An email header (RFC 2369) that gives mailbox providers a URL or address for unsubscribing the recipient, so they can show their own unsubscribe button.

In tinyRelay: Set List-Unsubscribe in the API's headers field; names are case-sensitive. If you don't, tinyRelay generates a default unsubscribe header.

A placeholder in an email body that is replaced with a value for each recipient, such as their first name.

In tinyRelay: Each recipient's attributes are rendered into the body as merge tags such as [FIRST_NAME]. Attributes are never echoed on webhooks; use metadata for that.

Data you attach to a send that the recipient never sees, but that comes back to you on events about it, such as an order ID.

In tinyRelay: Up to 10 keys, keys up to 64 characters, values up to 256. Per-recipient metadata merges over the request's and the recipient's keys win. Breaking the limits returns 412 before anything is sent.

A DNS record that names the mail servers that accept email for a domain.

In tinyRelay: Bounce category 24, Missing MX record, means the recipient's domain has no MX record, so there is nowhere to deliver.

An RFC 8058 method that lets a mailbox provider unsubscribe someone with a single POST request, signaled by List-Unsubscribe-Post: List-Unsubscribe=One-Click next to an HTTPS List-Unsubscribe URL.

In tinyRelay: Send both headers in the API request; your URL must accept a POST. Gmail and Yahoo ask bulk senders for one-click on marketing and subscribed mail.

Recording when an email is opened, usually with a tiny image loaded from the sender's server when the message is displayed.

In tinyRelay: An open-tracking pixel is inserted by default and OPEN events report opens. disableTrackingLinks: true turns off opens and clicks together; there is no separate switch.

A reverse DNS record that maps an IP address back to a hostname. Gmail and Yahoo expect sending IPs to have valid forward and reverse DNS.

In tinyRelay: Mail leaves from our sending infrastructure. Ask our team about reverse DNS for the IPs your mail uses.

A server that accepts email from one system and passes it on toward its destination.

In tinyRelay: tinyRelay is a relay for your app's email: you hand it messages over SMTP or the API, and it delivers them and reports back with signed events.

How long a webhook sender keeps event payloads so that missed events can be delivered again.

In tinyRelay: Event payloads are kept for 5 days. Within that window a missed event can be redelivered; after it, the payload is gone.

The envelope sender address, also called MAIL FROM or the bounce address, where bounce messages go. SPF is checked against its domain, not the visible From.

In tinyRelay: Custom return-path domains aren't covered in the tinyRelay docs; ask our team.

The domain in your From address, such as acme.com in no-reply@acme.com. Receivers judge it by its authentication records and reputation.

In tinyRelay: Share your sender domains with us so they are added to our MTA server, then add the DKIM CNAME for each one.

The Simple Mail Transfer Protocol (RFC 5321): the standard that mail servers and clients use to hand messages to each other.

In tinyRelay: Any SMTP client can send through tinyRelay with the credentials issued at onboarding. The host and port are shared then.

A service that accepts mail from your software over SMTP and delivers it for you, so you don't run your own outbound mail server.

In tinyRelay: Point a framework mailer, CMS or server at tinyRelay with the credentials we issue. It runs on the same infrastructure as the API.

A temporary delivery failure, such as a full mailbox or a failed connection, where a later retry may succeed.

In tinyRelay: BOUNCED events with subType SOFT_BOUNCED. Temporary categories (20, 21, 22, 23, 24, 29, 40, 70) are worth retrying; mail blocks (50 to 55, and 59) are worth investigating.

A recipient marking a message as spam. Mailbox providers track complaint rates, and Gmail and Yahoo ask senders to stay below 0.3%.

In tinyRelay: A SPAM webhook event arrives when an email is marked as spam, with your metadata attached, so your app can stop mailing that person.

Sender Policy Framework (RFC 7208): a TXT record listing the servers allowed to send mail using your domain in the envelope. A domain should publish one SPF record and stay within 10 DNS lookups.

In tinyRelay: PUT /domain/dns/check validates SPF and returns the record it expects. The docs' example SPF record includes _spf.tinyemail.com.

A list of addresses you no longer send to, such as hard bounces, unsubscribes and spam complaints.

In tinyRelay: The docs tell you to add hard-bounced addresses to your own suppression list. BOUNCED, UNSUBSCRIBE and SPAM events give you what you need to keep it current.

A webhook delivery service. Requests sent through it carry svix-id, svix-timestamp and svix-signature headers, and official Svix libraries can verify them.

In tinyRelay: tinyRelay delivers its webhooks through Svix, so the official Svix libraries verify them for you. Verifying by hand is supported too.

Email triggered by a person's action or an event in their account, such as a password reset, sign-in code, receipt or alert, sent to that one person.

In tinyRelay: This is what tinyRelay is built for, over SMTP or a REST API. Campaigns and newsletters belong in tinyEmail, our sister product.

An HTTP request a service sends to your URL when something happens, so you don't have to poll for updates.

In tinyRelay: tinyRelay POSTs every event to the webhook URL you give us at setup. Delivery is at least once, retried on timeout or 5xx, with repeats suppressed for 24 hours.

A cryptographic signature on a webhook request that proves who sent it and that it was not changed.

In tinyRelay: An HMAC-SHA256 over {svix-id}.{svix-timestamp}.{body}, keyed with your endpoint's own secret and sent in svix-signature. Compare in constant time and reject old timestamps.