Announcer

Authenticated email, sent on your own domain.

A per-domain DKIM keypair, a bounce address that keeps SPF aligned, and one API call to send. Receivers see a signature that validates against DNS you control — which is the whole of what DMARC asks for.

Per-domain keys

Every tenant domain gets its own 2048-bit keypair. The private half never leaves the host; you publish the public half as one TXT record.

Alignment by default

The envelope sender lives on a bounce domain we control, so SPF passes without you touching your root record. DKIM carries the alignment.

Verified before send

A domain cannot send until its DKIM record resolves in public DNS. No silently unsigned mail leaving with a success response.

Register a domain

# Returns the TXT record to publish.
curl -X POST https://mail.misralo.com/v1/domains \
  -H "Authorization: Bearer $ANNOUNCER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

Send

curl -X POST https://mail.misralo.com/v1/emails \
  -H "Authorization: Bearer $ANNOUNCER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "from":    "[email protected]",
        "to":      ["[email protected]"],
        "subject": "Signed, sealed",
        "text":    "Sent through Announcer."
      }'

The API lives at mail.misralo.com. Health is unauthenticated at /healthz.