What shipped, when.

Resend, Mailjet, MailerSend, Nuntly, and SMTP2GO join as first-class provider accounts: sending over their SMTP server or their API, delivery events, and a setup guide for each. Mailway now supports 12 providers, plus Gmail and any SMTP server.

After you add a provider account, the console checks that its credentials work, and can send one test email through it if you ask. A wrong key shows up at setup, not on the first real send.

A tested record of what each provider does to the copy it delivers: headers it adds or replaces, tracking, footers, and whether the sender's DKIM signature still verifies. Read it per provider.

A provider is added once, as an account. Mailway picks SMTP or the API for each send and records which one it used, so every send on the timeline says how it left. Bring your own keys.

Signed delivery, bounce, and complaint events from five more providers are matched to their sends, so a mail sent through any of them can reach delivered, not only accepted. Events without a valid signature are refused. Set them up per provider.

Pages for Amazon SES, SendGrid, Mailgun, and Postmark show what Mailway adds in front of a provider you already use, and the config change it takes.

When a provider refuses a mail, the retry to a provider the mail hasn't tried yet goes out after 5 s. A retry to a provider already tried still waits 1, 5, 15, then 30 min. How failover works.

The console's guided setup takes a new team from provider to project to SMTP credential to the first send, one step at a time. The same path in the docs.

The rule builder answers "would this match?" while you type: the draft's conditions run against your own recent mail — through the same filter engine live rules use — and show how many of the last mails would have matched, with real examples. A too-loose pattern is visible before you save it, not in tomorrow's mistagged mail. Single-rule preview, honestly labeled: other rules' effects aren't simulated.

A candid architecture & failure-semantics page: where a message becomes durable, what each failure looks like from your side, and how you roll back. This changelog shipped with it — launched with the real history below, not an empty container.

The HTTP API's machine-readable contract is published at /openapi.yaml — OpenAPI 3.1, including the webhook payloads and signature headers, validated against the live code by the API's own test suite so it can't drift. Generate a typed client, import it into Postman, or hand it to a coding agent. The whole surface speaks one documented error envelope, with Retry-After on rate limits.

Mail lists and detail pages show the sender domain's BIMI-published logo, resolved from the domain's own DNS record — never a third-party lookup service. Domains without one render a deterministic monogram and a nudge toward publishing BIMI.

The site and documentation are live and indexable. Mailway is in private beta, and we onboard teams one at a time from the waitlist.

The state ladder names every situation a mail can be in — including captured (a sandbox send: stored, never auto-forwarded) and exhausted (every retry on every provider spent, with a retry action). A mail always shows exactly where it stands.

Every delivery certificate is countersigned by an independent RFC 3161 timestamp authority — issuance can't be back-dated, not even by Mailway. Certificates keep verifying offline, with standard tools.

Replay a project's real traffic under a hypothetical provider setup — strategy changed, a provider removed — through the same routing engine live sends use. First-attempt routing only, honestly labeled; it projects routing, never delivery.

Sender DKIM signatures are cryptographically re-verified against the stored, as-received bytes — surfaced as shield chips in the mail list, a full Authentication panel on the detail page, and a dkim: search operator. It validates the sender's signature on what Mailway stored; it never claims to see the provider's downstream signing.

A captured sandbox mail can be explicitly released to send for real — never one-click: the dialog names the recipients, the provider route, and the capture's age before anything moves. How the sandbox works.

SMTP-ingested mail can ride API-type providers byte-for-byte where the provider accepts raw MIME. Structured-only providers require explicit, per-project consent to re-encode — never a silent mutation — and every attempt is stamped with its fidelity, visible in the console.

A fourth routing strategy: providers with free allowance left go first, counted approximately. Exhausted providers remain failover targets — deliverability outranks cost.

The rules engine — trigger, filter, action, per project or team — and outbound webhooks: seven lifecycle events, HMAC-SHA256 signatures with a timestamp, a retry ladder, and auto-disable for endpoints that stay down.

Shared mails on mailway.to render with Rendered / Text / Headers / Source views, downloadable attachments, the message's own SHA-256, and optional access passwords — and the first delivery certificates shipped alongside.

Four team roles — admin, developer, finance, member — over a central permission registry, and a team-wide audit log of every security-sensitive change.

Paste or upload HTML, pick a project and provider, preview, send. One-off mail without leaving the console — marked with its own console source chip, because provenance matters.

Provider delivery, bounce, and complaint events correlate to their sends on the timeline — provider-accepted and delivered tracked as separate claims. Hard bounces and complaints a provider reports land on per-project suppression lists enforced at send time, and a rescued-by-failover counter shows what the chain saved.

A create-a-team wizard — team, plan and payment, invitations — with Stripe checkout (live payments open at launch).

POST /v1/send with idempotency keys, 100-message batches, and a sandbox host where test keys can't send real mail. Why an API next to SMTP.

Registration with email verification, team invitations, a welcome wizard, password reset, TOTP + WebAuthn two-factor, and a per-user security log.

Production moved to Hetzner Cloud servers in Falkenstein, Germany — the EU home the platform runs on today (where everything runs).

The commitment to turn a private gateway into a product — starting with where it should live. A long evaluation of clouds versus dedicated hardware (outbound SMTP needs port 25, which most clouds restrict) ended with Hetzner Cloud in Falkenstein, Germany, provisioned for the move that followed.