Configure MailerSend inbound routing

MailerSend provides inbound route resources separately from its asynchronous sending API. Confirm account capability and use a credential with route-management permission only where administration requires it.

Create and verify the route

1. Follow the inbound routing reference, selecting the intended domain and recipient conditions.
2. Use the generated receiving address or publish the prescribed custom-domain DNS. Do not change employee-domain MX records without an approved migration.
3. Set a public HTTPS callback and implement its documented protection and payload format.
4. Use the route/DNS status fields returned by the service to distinguish pending configuration from a ready route.

List/read operations are useful for checking existing routes before creating another. Do not assume a sending-only token can administer routes or that a route must be recreated because an application parser failed.

Exercise receipt and failure

Send one controlled message to the configured recipient. Confirm route match, authenticated callback handling, attachment/body limits, and durable work before acknowledgement.

Deduplicate incoming messages and downstream effects. Treat sender headers/content as untrusted even when source verification succeeds, and keep outgoing delivery events out of the incoming-email handler.

For a MailKite receiving alternative, configure its verified destination and signature verifier separately. A MailerSend x-message-id from sending is not the identity of a new MailKite incoming event.