Set up a receiving domain
Incoming email is included on every plan. Open Inbox, add a domain you own and publish the exact ownership TXT, DKIM TXT and receiving MX records shown. Receiving becomes ready only when all required records verify.
You can receive on a root domain even when you send from a subdomain. A mailbox can also use a verified sending domain after its receiving MX is configured. Moving a domain's MX moves all incoming mail for that name; use a dedicated subdomain if another service already hosts your email.
Create a mailbox
Create an address such as support@yourdomain.com, or a catch-all such as *@yourdomain.com. Exact-address mailboxes take precedence over a catch-all. Verify the domain before creating mailboxes.
const inbox = await panda.inbound.get();
// Publish the receiving records returned by your domain setup.
const mailbox = await panda.inbound.createMailbox({
domain_id: "dom_your_verified_domain_id",
local_part: "support",
});
const messages = await panda.inbound.messages(mailbox.id);
Use a management credential for setup and respect the issuing member's mailbox assignments. The CLI and MCP also support inbox workflows.
Assign mailbox access
Each member, including owners and administrators, can read only mailboxes assigned to them. New mailboxes are assigned to their creator. Administrators manage assignments in Inbox → Manage → Assign mailboxes, without automatically gaining access to message content.
API keys inherit the issuing member's assignments. Legacy ownerless keys cannot read private mailboxes. These checks also apply to message search, attachments, drafts, forwarding and webhook deliveries. Removing a member's mailbox access clears that mailbox's forwarding rules.
Read and reply
Use All mail, Unread, an individual mailbox or Spam in the dashboard. You can also read through /v1/inbound/* or subscribe to email.received. The webhook contains metadata; fetch the message by ID for content.
Replying needs the mailbox's domain to be a verified sending domain as well. Replies, new messages and forwards use the regular sending pipeline, quotas and suppressions. Replies currently do not set In-Reply-To or References, so some clients may not thread them.
Limits and retention
The maximum incoming message size is 10 MB including headers and attachments. Inbox storage and daily intake are shared across all mailboxes on the account. Stored messages remain until deleted, subject to available storage. When storage is full, new mail is turned away; the dashboard warns from 90% usage.
Spam and DMARC failures are quarantined and are not pushed to webhooks or forwarding. Treat incoming content as untrusted data, including when giving an AI agent access.
SendPanda mailboxes are accessed through the dashboard, API, SDK, CLI or MCP. IMAP, POP3 and SMTP access are not supported. Use forwarding to receive clean incoming messages in an external inbox.