Blog
Field notes
Email infrastructure, AI agents, and what we learn shipping fast without breaking the things that matter.
- 10 min read
Build software that heals itself in the agentic era
In the agentic era, an AI agent can write the fix — but letting one patch production is terrifying unless the architecture makes it safe. Here's a software-design pattern for self-healing systems: never crash, turn every failure into a structured anonymous signature, and let an agent close the loop behind a sandbox and adversarial gates. Our open-source MIME parser is the worked example; the pattern applies far beyond it.
Read - 8 min read
You can't prompt your way out of prompt injection
Part two. In the last post I admitted I'd opened a security hole: I gave an agent an inbox and told it to follow instructions in emails. Here's the architecture I landed on — ACL-gated by design, so a fully hijacked agent still can't do any damage.
Read - 2 min read
Why aren't we seeing more agent security discussions?
Agents are writing our codebases and running on our platforms — and the security conversation hasn't caught up. A field note on the vectors that came back, and one I opened on myself.
Read - 5 min read
The Amazon SES alternative for developers
Amazon SES is the cheapest way to send at scale and the most assembly-required way to do anything else: sending starts sandboxed behind an AWS approval, bounce and complaint handling is your Lambda to write, and receiving means raw MIME dropped in an S3 bucket you fetch and parse yourself. Here's a fair comparison, and what MailKite does differently — send the moment DNS verifies, inbound as parsed JSON, no S3/SNS/Lambda/IAM.
Read - 5 min read
I wrote the same email parser three times — and the hard part was making them fail identically
Parsing MIME in Node, Python, and Go is the easy part. Getting all three to break the same way on the same broken email — and to say so with the same hash — is where the real work is. Here's how, and the two lessons that transfer to any polyglot library.
Read - 5 min read
The honest Mailgun Routes alternative
Mailgun Routes is a filter-expression engine for inbound mail: you write match_recipient/match_header rules that fire forward() and store() actions, and Mailgun POSTs the parsed message to your endpoint as form-encoded fields. MailKite is a routes alternative that drops the rule DSL — point an address or catch-all at a webhook and the message arrives as a single JSON payload with decoded text/html, SPF/DKIM/DMARC results, and signed attachment URLs. Here's a fair comparison, and where I won't overclaim.
Read - 5 min read
Deliverability is a black box, and shared IPs let strangers tank you
On shared-IP transactional email, a stranger's spam can sink your inbox placement — and the provider hands you a black box instead of an answer. Here's what actually moves the needle: real SPF/DKIM/DMARC, a monitored stream, and an auth field you can read.
Read - 5 min read
Give your AI agent its own email inbox
An AI agent that can't receive email is half-deaf. Here's how to give an agent a real, scoped address on your own domain — inbound parsed to JSON, an event.received loop, and autonomous replies over the same API you already use.
Read - 3 min read
Receive email in Python (Django & FastAPI)
Install mailkite-dev, point a domain at MailKite, and receive parsed inbound email as JSON in a Django view or a FastAPI handler. The one rule that matters: verify the signature against the raw request body — request.body in Django, await request.body() in FastAPI.
Read - 5 min read
They killed my account with no warning
The developer-email industry has a pattern: silent suspensions, unappealable bans, and free tiers that vanish the moment they cost the vendor money. Here's the pattern, the receipts, and the stance we took to not become another one.
Read - 4 min read
Build a support inbox in Next.js (email in, tickets out)
Point support@yourdomain at MailKite, parse the inbound email to JSON, and POST it to a Next.js Route Handler. Verify the signature against the raw body, create a ticket, and auto-reply — the whole loop, in real code.
Read - 5 min read
The honest SendGrid Inbound Parse alternative
SendGrid Inbound Parse POSTs your inbound mail as multipart/form-data and leaves the parsing, decoding, and attachment handling to you — with a well-earned reputation for encoding and attachment mangling. Here's a fair comparison, what MailKite does differently (fully parsed JSON, auth results, signed attachment URLs, no daily cap), and what it doesn't.
Read - 5 min read
Cloudflare Email Routing can't reply — here's how to send from your domain
Cloudflare Email Routing forwards inbound mail beautifully and Email Workers hand you the raw message — but there's no first-class way to reply or send from your own domain. Here's exactly where the gap is, why the 'just add Email Service' answer is more assembly than it sounds, and how to receive parsed JSON and reply from one API instead.
Read - 6 min read
Handling email attachments without losing the £ sign
Inbound attachments are where email parsing goes to die — inline base64 that bloats every webhook, and charset bugs that turn £ into £. Here's why it happens, why SendGrid Inbound Parse is infamous for it, and what a clean attachments[] array with signed URLs looks like instead.
Read - 5 min read
Verify your inbound email webhooks (HMAC — and why you must)
An unverified webhook endpoint is an open door: anyone can POST a fake email.received event. Here's how to verify the HMAC signature in Node, Python, and Go — and why the raw body matters.
Read - 4 min read
Reply-by-email: handling inbound replies in your app
When users reply to your notification emails, capture the reply, thread it to the right conversation, and respond — either with an inline ack or a real outbound message.
Read - 4 min read
Parse inbound email to JSON in Node.js
A hands-on Node.js walkthrough: point a domain at MailKite and receive every inbound email as clean, decoded JSON in one webhook — verify it, then read text, html, and attachments.
Read - 7 min read
Receiving email is the part nobody warns you about
Sending email is a solved problem. Receiving it — turning real-world MIME into something your app can use — is where everyone quietly loses a week. Here's why inbound is the hard direction, how each option punts, and what one clean webhook looks like instead.
Read