Transactional email API and SMTP

Transactional email that reaches the inbox

Send password resets, sign-in codes, receipts and order updates from your app or website. Use the REST API or SMTP, send from your own domain with DKIM, and see what happened to every email.

POST /api/v1/mail/send200 OK
{
  "to": "[email protected]",
  "subject": "Reset your password",
  "html": "<p>Click the link to choose a new password.</p>"
}
{ "ok": true, "sent": true, "mode": "domain", "message_id": "<…>" }
5,000 free emails a monthNo credit cardAPI and SMTPYour own domain
One emailQueuedDKIM signedSpam checkDeliveredOpenedDone
securessmtp.com/how-it-works
Sending
OVER THE APIYour appNode · PHP · Python · GoOVER SMTPWordPress & formsPort 587 or 465Sign & checkDKIM · spam scoreSECURESMTPGmail250 OKOutlook250 OKYahoo Mail250 OKiCloud Mail250 OKProton Mail250 OKZoho Mail250 OKAOL Mail250 OKWork email250 OK
Two ways in, one queue — signed with your domain and delivered to the inbox.

The dashboard

See every email, live.

Example data — nothing here is sentCreate a free accountSign in
Email log
[email protected]

Sent this month

12,480

of 50,000

Delivered

99.2%

Opened

61.4%

Bounced

0.4%

ToSubjectStatusUTC
[email protected]Reset your passwordopened14:02:11
[email protected]Your receipt for order #4818delivered14:01:58
[email protected]Your sign-in code is 902 114clicked14:01:40
[email protected]Welcome to Acmebounced14:01:22
[email protected]New contact form messagedelivered14:00:57
[email protected]Your order has shippedopened14:00:31

Every email with its status, the receiving server’s reply, opens and clicks.

Templates, automations and hosted forms are in the dashboard too. Open your free dashboard →

Send from any language, framework or platform

JSNode.jsAPI + SMTP
PyPythonAPI + SMTP
phpPHPAPI + SMTP
LLaravelSMTP
djDjangoSMTP
RbRuby on RailsSMTP
GoGoAPI + SMTP
WWordPressPlugin
SShopifySMTP
NNext.jsAPI
JvJavaAPI + SMTP
.N.NETAPI + SMTP
>_cURLAPI
@Any SMTP clientSMTP

API + SMTP

POST /mail/sendSMTP :587

Two ways to send

16

email.sent → 200

Webhook events

2048-bit

v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu7Qx2kfS9cG1vX… v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu7Qx2kfS9cG1vX…

DKIM keys for your domain

5,000

No card. Resets on the 1st.

Free emails every month

What people send

The emails your users are waiting for.

Transactional email goes to one person because of something they did. It has to arrive quickly, and it has to land in the inbox.

Password resets and sign-in codes

Delivered in seconds and signed for your domain, so people are not left waiting at the login screen.

Receipts and invoices

Send the receipt with the PDF attached. Attachments up to 15 MB per email.

Order and shipping updates

Confirmations, payment and shipping emails from your store or app, filled in from a template.

Shopify app

Account and security alerts

New sign-ins, plan changes, failed payments and anything else your users need to know about.

Website form notifications

Contact, quote and booking requests delivered to your inbox instead of spam.

WordPress plugin

Follow-up sequences

Welcome and onboarding emails sent over days to people who signed up, with an unsubscribe link in each.

How sequences work

For developers

Send your first email in a few lines.

One POST request with your API key. No package to install: it works with the HTTP client you already use.

  • HTML or plain text, CC and BCC, reply-to, custom headers and attachments
  • Saved templates with {{variables}}: send by template name with your data
  • Prefer SMTP? Host smtp.securessmtp.com, port 587 or 465, your API key as the password
curl -X POST https://securessmtp.com/api/v1/mail/send \
  -H "x-securessmtp-api-key: $SECURESSMTP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "to": "[email protected]",
  "subject": "Your receipt from Acme",
  "html": "<p>Thanks for your order.</p>"
}'

What you get

Everything transactional email needs.

signed by yourstore.com
SPF DKIM DMARC

Send from your own domain

Add your domain and publish one DKIM record. Every email is signed as you, so SPF, DKIM and DMARC pass.

ana@…Delivered
ben@…Opened
old@…Bounced

A log entry for every email

Sent, delivered, opened, clicked or bounced, with the receiving server’s reply when something goes wrong.

POST yourapp.com/hooks
email.delivered200
email.bounced200
email.unsubscribed200

Webhooks for every event

Delivered, bounced, opened, clicked, complained, unsubscribed and more, posted to your server and signed.

Suppressed · address does not exist
List-Unsubscribe-Post:
List-Unsubscribe=One-Click

Bounces and unsubscribes handled

Addresses that do not exist or reported spam are skipped from then on. One-click unsubscribe headers are added for you.

password-reset
{{name}}{{reset_link}}

Templates with variables

Save an email once in the dashboard, then send it by name with your own values, from the API or a sequence.

4
spam score · clean

Checked before it leaves

Every email is checked for spam content before it is sent, so one bad sender does not hurt everyone’s delivery.

MCP

Send email from Claude, Cursor and other AI tools

Connect any MCP client to send email, manage sending domains and read delivery numbers in plain language, with OAuth or an API key.

About the MCP server

How it works

Your app in. Authenticated email out.

Every email is signed with your domain, checked for spam and queued. Then you get each delivery event back.

YOUR APP OR SITE{ }REST APIPOST /api/v1/mail/send@SMTPPort 587 or 465WWordPressPlugin, one clickSecureSMTPDKIM signedSpam check passedQueued for deliveryTHE INBOXMGmailDeliveredOOutlookDeliveredYYahoo MailDeliveredYour webhookemail.delivered
  1. 1Add your sending domainPublish one DKIM record. We check the DNS for you.
  2. 2Send with the API or SMTPOr install the WordPress plugin and keep your forms.
  3. 3Follow every emailStatus in the email log, events by webhook.

Spam protection

Spam we stopped before it was sent.

Every email is checked before it leaves. Spam is refused, so it never touches your domain’s reputation or ours. These are live numbers from SecureSMTP.

Spam emails stopped

1,883

Last 24 hours

61

Last 30 days

1,881

Sites protected

31

Stopped per day

last 14 days, UTC

How it was caught

Spam content check1,687

Spammy words, links and patterns scored before sending

AI classifier152

Messages the AI model marked as spam or abuse

Held form spam44

Contact-form spam held instead of mailed to the site owner

Latest spam stopped

Reason and time only. Addresses and content stay private.

Spam content check1 h ago
Spam content check1 h ago
AI classifier2 h ago
Spam content check4 h ago
Spam content check5 h ago
Spam content check5 h ago
Spam content check5 h ago
Spam content check5 h ago

Plus 12 addresses on suppression lists after hard bounces, complaints or unsubscribes, so they are never mailed again.

Why it matters

From “did it send?” to a record of every email.

Sending from your own server
  • Password reset emails land in spam or never arrive
  • No DKIM signature for your domain, so Gmail and Outlook distrust it
  • No record of what was sent, or why it bounced
  • Dead addresses keep getting mailed and hurt your reputation
Sending with SecureSMTP
  • Every email signed for your domain: SPF, DKIM and DMARC pass
  • A log entry for each email: sent, delivered, opened, bounced
  • Hard bounces and spam reports stop future sends automatically
  • Webhooks tell your app what happened to each email

Pricing

Pay for the emails you send.

Every plan includes the API, SMTP, webhooks and the email log. Paid plans start with a 14-day free trial.

Free

$0/mo

5,000 emails / month

Start free

Includes

  • 5,000 emails a month
  • 100 hosted form submissions a month
  • 1 site and 1 team seat
  • REST API and SMTP (ports 587 and 465)
  • WordPress plugin with one-click setup
  • Shared sending domain with SPF and DKIM
  • Email log with every delivery status
  • Open and click tracking
  • Webhooks for delivery and form events
  • Templates with variables
  • Bounce, complaint and unsubscribe suppression list
  • Spam check on every email
  • MCP server for AI agents
  • Community support

Starter

$7/mo

50,000 emails / month

Start free trial

Everything in Free, plus

  • 50,000 emails a month
  • 1,000 hosted form submissions a month
  • Up to 3 sites and 3 team seats
  • Send from your own domain (DKIM)
  • Bounce return-path on your domain
  • Shopify, Squarespace and Webflow SMTP
  • AI abuse scanning on outgoing mail
  • Full hosted form builder
  • Email support
  • 14-day free trial, no card needed
Most popular

Pro

$19/mo

250,000 emails / month

Start free trial

Everything in Starter, plus

  • 250,000 emails a month
  • 10,000 hosted form submissions a month
  • Up to 10 sites and 10 team seats
  • Hosted forms you can embed anywhere
  • DMARC alignment guidance
  • Priority email support
  • 99.95% uptime SLA
  • 14-day free trial, no card needed

Business

$49/mo

1,000,000 emails / month

Start free trial

Everything in Pro, plus

  • 1,000,000 emails a month
  • 50,000 hosted form submissions a month
  • Unlimited sites
  • 25 team seats with roles
  • Priority onboarding call
  • Priority support
  • 14-day free trial, no card needed

Common questions

Transactional email questions, answered.

Email your app or website sends to one person because of something they did: a password reset, a sign-in code, a receipt, an order or shipping update, an account alert. People expect these emails and often need them right away, which is why they must reach the inbox. Newsletters sent to a whole list are marketing email, not transactional.

Use the REST API when you send from your own code: one POST request with the recipient, subject and body. Use SMTP when your software already has SMTP settings, such as WordPress, Laravel, Django, Rails or most apps: host smtp.securessmtp.com, port 587 (STARTTLS) or 465 (SSL), username securessmtp and your API key as the password. Both go through the same checks and show up in the same email log.

Yes, on paid plans. Add your domain in the dashboard and publish the DKIM record we give you. Emails are then signed as your domain, so SPF, DKIM and DMARC pass at Gmail, Outlook and Yahoo. On the free plan, emails go out from our shared, authenticated sending domain with your name and your reply-to address.

Every email gets an entry in the email log showing whether it was sent, delivered, opened, clicked or bounced, with the receiving server’s reply. You can also get these events posted to your own server with webhooks, so your app knows right away.

If an address does not exist or the recipient reports your email as spam, the address is added to your suppression list and later emails to it are skipped, which protects your sender reputation. Bounces caused by content or temporary problems never block the address. You can remove an address from the list in the dashboard.

SecureSMTP is built for transactional email. You can send follow-up sequences to people who signed up, with an unsubscribe link in every email. Marketing email needs the recipients’ consent, and unsolicited bulk email is not allowed under our acceptable use policy.

On our own servers in Germany, hosted by Hetzner. Our privacy policy and data processing agreement list everything we store and for how long.

5,000 emails a month for one site, with the API, SMTP, webhooks and the email log. No credit card needed. Paid plans add more emails and sites, and sending from your own domain.

Start sending transactional email today.

5,000 free emails every month · API and SMTP · No credit card required.