Inbound MX Routing & Token-Optimized Webhooks

Quickstart: 2-minute MX setup

To start receiving inbound emails on your custom domain or subdomain, add a single DNS MX record pointing to SadaSend’s dedicated inbound mail receivers:

Address pattern matching & routing rules

SadaSend provides powerful pattern-matching rules so you can route emails to different webhook endpoints based on how customers address them:

• Exact Addresses: Match specific mailboxes (e.g. support@yourdomain.com or billing@yourdomain.com).

• Prefix Wildcards: Match any address starting with a prefix across your domains (e.g. help@* or contact@*).

• Domain Wildcards: Route any email sent to a specific domain or subdomain (e.g. *@inbound.yourdomain.com).

• Plus-Addressing (Tagging): Route tagged emails to specific workflows (e.g. tickets+*@yourdomain.com passes the tag to your backend).

• Catch-All Default: Catch any unmatched email sent to your verified domains and deliver it to your fallback endpoint.

curl -X POST https://api.sadasend.com/inbound/routes \
  -H "Authorization: Bearer sada_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "pattern": "support@*",
    "webhook_url": "https://api.yourdomain.com/webhooks/email-inbound",
    "priority": 10,
    "filter_spam": true,
    "strip_signatures": true,
    "extract_markdown": true
  }'

Token-optimized clean Markdown (~85% reduction)

Customer emails are filled with noise that wastes precious LLM context window tokens and increases inference costs: recursive forwarding headers, nested blockquotes (> On Oct 14...), corporate legal disclaimers, and mobile signatures (Sent from my iPhone).

SadaSend’s inbound parser automatically strips this noise and converts the core conversational message into clean, compact Markdown:

{
  "id": "inmsg_01h8x9p3abc74k",
  "message_id": "<cab83@mail.gmail.com>",
  "from": {
    "name": "Sarah Connor",
    "email": "sarah@example.com"
  },
  "to": "support@yourdomain.com",
  "subject": "Re: Password reset instructions",
  "clean_markdown": "Thank you! I received the reset link and updated my password successfully.\n\nCan you also verify if my 2FA backup codes were invalidated?",
  "raw_text": "Thank you! I received the reset link and updated my password successfully...\n\n> On Wed, Oct 28 at 2:15 PM Acme Support wrote:...\nSent from my iPhone",
  "threat_score": 0.02,
  "has_attachments": false,
  "spf": "pass",
  "dkim": "pass",
  "dmarc": "pass"
}

Prompt injection threat scoring

Feeding raw, untrusted email content directly into an autonomous AI agent creates significant security vulnerabilities. Adversaries frequently hide prompt injection attacks, delimiter overrides, and jailbreak instructions inside incoming email bodies or hidden HTML tags.

SadaSend analyzes every incoming message for common jailbreak patterns, system prompt override attempts, and hidden zero-width text, scoring threat probability from 0.0 (benign) to 1.0 (high risk):

• Low Risk (`< 0.3`): Safe to feed directly into agent conversational prompts.

• Medium Risk (`0.3 – 0.7`): Flagged for quarantine or sanitized agent execution.

• High Risk (`> 0.7`): Blocked or routed to a human review queue with prompt injection warning tags.

Webhook security & HMAC-SHA256 signature verification

Every inbound webhook dispatched to your server includes a cryptographic X-SadaSend-Signature-256 header. Always verify this signature in your backend to ensure requests originate exclusively from SadaSend:

import crypto from 'node:crypto';

export function verifySadaSendWebhook(
  rawBody: string,
  signatureHeader: string,
  secret: string
): boolean {
  const hmac = crypto.createHmac('sha256', secret);
  const digest = 'sha256=' + hmac.update(rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(digest), Buffer.from(signatureHeader));
}

Live simulation without sending network emails

You do not need to send real network emails from Gmail or Outlook to test your inbound routing logic. Use the simulation API or the interactive simulator in your dashboard (/app/webhooks?tab=inbound):

curl -X POST https://api.sadasend.com/inbound/simulate \
  -H "Authorization: Bearer sada_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "to": "support@yourdomain.com",
    "from": "user@example.com",
    "subject": "Testing Inbound Routing",
    "text": "Hello support!\n\nSent from my iPhone"
  }'