Mail addressed to one of your inboxes is accepted, written to storage, parsed, threaded and stored — usually within a couple of seconds. Then it is on GET /v0/inboxes/{id}/messages.

Every message carries its verdicts

The receiving path checks SPF, DKIM and DMARC before we ever see the message, and those results are recorded. A message that fails DMARC — or fails both SPF and DKIM — is labelled unauthenticated.

It is kept, not dropped. You can list it explicitly and inspect it. It is simply not returned by default, because handing an agent spoofed mail as though it were genuine is the whole attack this is defending against.

Spam and virus verdicts apply the spam label the same way.

Nothing is acknowledged before it is stored

If storing a message fails — a transient outage anywhere in the path — the delivery is not acknowledged, and it is retried. Anything that exhausts its retries goes to a dead-letter queue and raises an alarm rather than disappearing.

Permanent failures are acknowledged instead: mail for an address that does not exist can never succeed, and retrying it only burns the delivery budget.

Reacting to arrival

Polling works. Webhooks are better — you get message.received pushed the moment it lands.