For SaaS and transactional email
A filtered password resetis a support ticket.
Transactional email is infrastructure, and it fails the way infrastructure fails: quietly, after a change nobody connected to email, in a system no engineer is watching.
14-day free trial · no credit card · cancel anytime
LitInboxes is an email deliverability monitoring platform for businesses and agencies that depend on email for revenue, customer communication, or client results.
The problem
Where it breaks for a product team
All five are configuration problems, which means all five are detectable.
- 01
Resets and receipts get filtered
A user who never receives the reset link cannot log in. That is a churn event, and it arrives in your tracker as a product bug.
- 02
The sending domain drifts after a change
A new SES identity, a rotated DKIM key, a Terraform apply that rewrote a TXT record. Nothing errors, and the next reset lands in spam.
- 03
DKIM rotation is invisible
Providers rotate keys and add selectors. Monitoring that checks a single selector reports green while a real signing key is unpublished.
- 04
MTA-STS and BIMI are set and forgotten
The policy file expires, or the DNS record and the hosted policy stop agreeing. Nobody checks a thing that worked once.
- 05
Alerts do not reach on-call
Deliverability lives in a marketing tool nobody on the engineering rota opens. If it does not reach the channel you watch, it is not monitoring.
The fix
What LitInboxes does about it
The same monitoring, addressed to engineers instead of marketers.
- 01
Authentication checked every 6 hours
SPF with its lookup count, DKIM for up to three selectors per domain, DMARC policy and alignment, MTA-STS and BIMI. Re-resolved and compared, so a change becomes an event.
- 02
Alerts into Slack
Slack, Discord or a webhook on Pro, email on every plan, carrying what changed and the corrected value, so whoever is on call gets the same output as the person who owns deliverability.
- 03
DMARC reports parsed for you
Point rua at LitInboxes and aggregate reports are ingested and grouped by sending source, which is how you find the internal system nobody authenticated.
- 04
The data in your stack, not only a dashboard
A REST API with per-resource scoped keys on Pro, plus a hosted MCP server with OAuth 2.1, so an AI assistant can answer why is our reset email going to spam against your own workspace.
- 05
Bounce and complaint events with context
ESP webhooks feed bounce and complaint events into the same workspace as your DNS and blocklist state, so a spike arrives with the reason next to it.
In the product
Every record, every check
The infrastructure view lists each record, what resolved, whether it passes, and what to change. It reads like a check output, because that is what it is.
DNS & authentication
SPF, DKIM, DMARC and MTA-STS, rechecked every 6 hours.
DMARC
99.2%912 reports · 48,120 messages
Deliveries
Healthy0.02% complaint rate
Blocklists
CleanSpamhaus, Barracuda, SpamCop and 21 more
Recent activity
The domain overview, as it looks in the app.
The numbers
What you actually monitor
Four checks that catch the configuration failures that filter transactional mail.
SPF lookup count
How many DNS lookups your SPF record costs, measured against the limit of 10.
Bad looks likeAt 10 or more, SPF returns permerror and stops passing everywhere.
DKIM per selector
Up to three selectors per domain, each resolved and validated on its own rather than as a single pass or fail.
Bad looks likeA selector that stops resolving after a provider rotates keys.
DMARC policy and alignment
The published policy, the reporting addresses, and whether real mail aligns with the domain it claims.
Bad looks likep=none indefinitely, or aligned mail dropping after a subdomain change.
MTA-STS and BIMI
The policy record, the hosted policy file, and whether the two still agree.
Bad looks likeA max_age that lapsed, or a policy file that no longer matches the record.
The mechanism
Why transactional deliverability is a configuration problem
Transactional email tends to work until something changes. An SPF include added by a new vendor pushes the record past 10 DNS lookups and SPF starts returning permerror. A provider rotates DKIM keys and publishes a new selector while your zone still advertises the old one. A service starts sending from a subdomain that inherits no policy from the root. None of these are mysteries. They are configuration states, and configuration states can be asserted on.
Which makes this monitorable the way the rest of your infrastructure is monitorable: define the expected state, re-resolve it on a schedule, diff it against the last known good, and raise an event on the difference. That is what the 6-hour check loop does across SPF, DKIM per selector, DMARC policy and alignment, MTA-STS and BIMI. DMARC aggregate reports close the loop from the other direction by naming systems that send as you, including the ones no one registered.
The gap in most teams is ownership rather than tooling. Deliverability signals sit in a marketing tool, while the people who can fix DNS are on an engineering rota that never opens it. Slack alerts, a scoped REST API and a hosted MCP server exist for exactly that reason: to put the signal where the on-call person already looks.
Getting started
Your first twenty minutes
Step two is the one that catches rotations.
- 01
Add the domain your app sends from
Usually a subdomain like mail.yourapp.com, or the SES identity domain, rather than your marketing site.
- 02
List your DKIM selectors
Add up to three per domain, so a provider rotation cannot hide behind the one selector you happened to check.
- 03
Send DMARC reports to LitInboxes
Update rua in the DMARC record. Aggregate reports arrive daily from the large providers and are grouped by source.
- 04
Wire alerts to the channel you watch
Slack, Discord or a webhook on Pro, or pull the state through the REST API if you would rather route it into your own alerting.
Plan fit
Which plan fits a product team
Pro, $99/mo
The API, the MCP server, Slack alerts and the 24-list sweep are Pro. Fifty domains covers production, staging and regional senders without a second workspace.
- 50 monitored domains
- REST API with per-resource scoped keys
- Hosted MCP server with OAuth 2.1
- Email, Slack, Discord and webhook alerts
- 24 months of history
Honest limits
When LitInboxes is the wrong tool
Three things a product team might want that this does not do.
- You want an SMTP relay or a sending service. LitInboxes monitors, it does not send.
- You want per-message delivery logs. Your ESP has those. This watches domain-level trust.
- You want API or MCP access on Starter or Growing. Both are Pro-only.
Questions
Questions from this crowd
- Do you send transactional email?
- No. Keep SES, Postmark, Resend, SendGrid or your own MTA. LitInboxes monitors the domains they send from and the records that make them trusted.
- How many DKIM selectors can you check?
- Up to three per monitored domain, each resolved and validated separately so a rotation surfaces as a specific failure.
- Is there an API?
- Yes, on Pro. Bearer keys prefixed lit_, scoped per resource, a documented OpenAPI 3.0 spec, and per-IP and per-key rate limits with Retry-After on 429.
- Can an AI assistant query this?
- Yes, on Pro. The hosted MCP server uses OAuth 2.1 with PKCE and exposes domain health, DNS records, DMARC summaries, Postmaster data, blocklist status, email events, alerts and verification.
- Do you support subdomain DMARC policies?
- Yes. Add the subdomain as its own monitored domain and its policy, alignment and reports are checked separately from the root.
- How quickly is a change detected?
- Checks run every 6 hours per domain, and you can trigger one on demand at any time.
Related reading
- Why Is My Email Going to Spam? A Calm DiagnosticSpam placement is almost always an identity or reputation problem, not a wording problem. Work the causes in the order receivers actually weigh them.
- The Weekly Deliverability Review: What to Check on Every Client DomainFour signals drift without announcing it. Here is what each one means when it moves, the order to triage them in, and where a weekly pass stops being enough.
Wire deliverability checks into your stack.
Authentication, blocklists and DMARC reports on a 6-hour loop, with an API and an MCP server on Pro.
14-day free trial on every plan. No credit card required, nothing is charged unless you choose a plan, cancel anytime.