> ## Documentation Index
> Fetch the complete documentation index at: https://inbound.new/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Mailboxes & SMTP

> Connect to Inbound with scoped, managed IMAP and SMTP credentials

Inbound gives your email clients and applications direct access to email through standard IMAP and SMTP. Create managed credentials in the [Mailboxes & SMTP dashboard](https://inbound.new/mailboxes), choose which verified domains or addresses they can access, and connect using the generated login email and password.

## Connection settings

| Protocol | Host | Port | Security |
| - | - | - | - |
| IMAP | `imap.inboundemail.com` | `993` | TLS |
| SMTP | `smtp.inboundemail.com` | `465` | TLS |
| SMTP | `smtp.inboundemail.com` | `587` | STARTTLS |

Use the credential's **Login email** and generated password. IMAP requires a **Mailbox + SMTP** credential. SMTP sending works with **SMTP only** credentials and with **Mailbox + SMTP** credentials that have **Read & write** access. All connections require TLS 1.2 or later: IMAP uses implicit TLS only, and SMTP on port `587` must upgrade with STARTTLS before authentication. See [Connect with IMAP](https://inbound.new/docs/mailboxes/connect-imap.md) and [Send with SMTP](https://inbound.new/docs/mailboxes/connect-smtp.md) for client settings.

## How it works

A managed credential combines three things:

1. **An identity** - A login email and generated password used to authenticate.
2. **Access scopes** - One or more verified domains or exact email addresses the credential can access.
3. **Permissions** - The available protocols, IMAP access level, and authorized SMTP sender addresses.

For **Mailbox + SMTP** credentials, Inbound provides `INBOX`, `Sent`, `Drafts`, `Trash`, `Junk`, and `Archive`, plus read-only folders for individual scopes. The [HTTP mailbox API](https://inbound.new/docs/mailboxes/http-api.md) shares these folders, messages and flags with IMAP. The combined `INBOX` contains received mail covered by the credential's scopes, and `Junk` holds mail the [junk filter](https://inbound.new/docs/mailboxes/junk-filter.md) marked. With **Read & write** access, SMTP uses the same login email and password, enforces the credential's sender policy, and saves each sent message to `Sent`.

> [!NOTE]
>
> The login email must use an exact domain you own and have verified when you create or edit the credential. It is an authentication username and does not need to match the receiving or sending addresses, which are controlled separately by scopes and sender policy.

## Choose a credential type

| Credential type | IMAP | SMTP | Best for |
| - | - | - | - |
| **Mailbox + SMTP** | **Read only** or **Read & write** access | Send using the configured sender policy (**Read & write** only) | Email clients and applications that receive and send mail |
| **SMTP only** | Not available | Send using the configured sender policy | Applications and services that only send mail |

For **Mailbox + SMTP**, select **Read & write** if your client needs to send mail, save messages in `Sent` or `Drafts`, or change message flags. **Read only** allows reading over IMAP and the mailbox HTTP API: the credential cannot send through SMTP or the API. Scope-specific folders remain read-only with either setting.

For send-only applications, create an **SMTP only** credential and use either SMTP configuration above. The same scope and sender-policy rules still apply.

Both credential types require at least one scope covering a whole verified domain, such as `*@example.com`, or one exact address, such as `support@example.com`.

> [!WARNING]
>
> **Any scoped domain** permits sending from every address on a represented domain, even when the receiving scope covers only one address. For example, a scope for `support@example.com` also permits SMTP sending from `billing@example.com`. Select **Exact identity** to restrict sending to one address.

> [!NOTE]
>
> [Add and verify a domain](https://inbound.new/emails) before creating a credential. Only verified domains appear in the scope selector. Receiving mail also requires the domain's receiving MX records to be configured and verified.

## Mail-scoped API keys and security

The generated credential password is itself a mail-scoped API key, typically beginning with `mail_`; older credentials can begin with `imap_`. It authenticates IMAP and SMTP alongside the login email and, for **Read & write** and **SMTP only** credentials, can also authorize HTTP email sending under the same sender policy. A **Read only** password is refused with `403` by the sending endpoints. It cannot manage account resources.

Ordinary account API keys, often stored as `INBOUND_API_KEY`, are a separate credential type. They can access permitted HTTP API resources but cannot authenticate to IMAP or SMTP.

When you create or rotate a credential, its password is shown exactly once. Save it in a password manager or secret manager. If it is lost or exposed, use **Rotate password** immediately; the previous password stops working at once.

> [!WARNING]
>
> Anyone with the managed password can send mail allowed by its sender policy. Never expose it in source code, commit it to version control, or disable TLS certificate verification. Disabling or deleting a credential prevents further use.

## Next steps

> [card] [Connect with IMAP](https://inbound.new/docs/mailboxes/connect-imap.md)
>
> Create a credential and configure an email client or application

> [card] [Send with SMTP](https://inbound.new/docs/mailboxes/connect-smtp.md)
>
> Send from any SMTP client, with limits and reply codes

> [card] [Scopes and Permissions](https://inbound.new/docs/mailboxes/scopes-and-permissions.md)
>
> Understand domain scopes, address scopes, sender policies, and IMAP access

> [card] [Manage Credentials](https://inbound.new/docs/mailboxes/manage-credentials.md)
>
> Edit, rotate, disable, enable, or delete managed credentials

> [card] [IMAP Behavior](https://inbound.new/docs/mailboxes/imap-behavior.md)
>
> Folders, supported IMAP features, limits, and known limitations

> [card] [HTTP Mailbox API](https://inbound.new/docs/mailboxes/http-api.md)
>
> Read and organize the same folders, messages and flags over HTTP

> [card] [Junk Filter](https://inbound.new/docs/mailboxes/junk-filter.md)
>
> How spam lands in Junk, and per-mailbox spam settings

> [card] [Mailbox Filters](https://inbound.new/docs/mailboxes/filters.md)
>
> Sort, flag, and junk received mail with ordered rules

> [card] [Access and Limits](https://inbound.new/docs/mailboxes/access-and-limits.md)
>
> Restrict protocols and IP addresses, cap storage and sends, and enable self-service


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.