What shipped, when.

A candid architecture & failure-semantics page: where a message becomes durable, what each failure looks like from your side, and how you roll back. This changelog shipped with it — launched with the real history below, not an empty container.

The Send API's machine-readable contract is published at /openapi.yaml — OpenAPI 3.1, including the webhook payloads and signature headers, validated against the live code by the API's own test suite so it can't drift. Generate a typed client, import it into Postman, or hand it to a coding agent. The whole surface speaks one documented error envelope, with Retry-After on rate limits.

Mail lists and detail pages show the sender domain's BIMI-published logo, resolved from the domain's own DNS record — never a third-party lookup service. Domains without one render a deterministic monogram and a nudge toward publishing BIMI.

The site and documentation are live and indexable. Registration opens by invitation from the waitlist while the platform finishes its pre-GA hardening.

The state ladder names every situation a mail can be in — including captured (a sandbox send: stored, never auto-forwarded) and exhausted (every retry on every provider spent, with a retry action). A mail always shows exactly where it stands.

Every delivery certificate is countersigned by an independent RFC 3161 timestamp authority — issuance can't be back-dated, not even by Mailway. Certificates keep verifying offline, with standard tools.

Replay a project's real traffic under a hypothetical provider setup — strategy changed, a provider removed — through the same routing engine live sends use. First-attempt routing only, honestly labelled; it projects routing, never delivery.

Sender DKIM signatures are cryptographically re-verified against the stored, as-received bytes — surfaced as shield chips in the mail list, a full Authentication panel on the detail page, and a dkim: search operator. It validates the sender's signature on what Mailway stored; it never claims to see the provider's downstream signing.

A captured sandbox mail can be explicitly released to send for real — never one-click: the dialog names the recipients, the provider route, and the capture's age before anything moves. How the sandbox works.

SMTP-ingested mail can ride API-type providers byte-for-byte where the provider accepts raw MIME. Structured-only providers require explicit, per-project consent to re-encode — never a silent mutation — and every attempt is stamped with its fidelity, visible in the console.

A fourth routing strategy: spend your providers' free tiers before a single paid send. Exhausted providers remain failover targets — deliverability outranks cost.

The rule engine — trigger, filter, action, per project or team — and outbound webhooks: seven lifecycle events, Stripe-style HMAC signatures, a retry ladder, and auto-disable for endpoints that stay down.

Shared mails on mailway.to render with Rendered / Text / Headers / Source views, downloadable attachments, the message's own SHA-256, and optional access passwords — and the first delivery certificates shipped alongside.

Four team roles — admin, developer, finance, member — over a central permission registry, and a team-wide audit log of every security-sensitive change.

Paste or upload HTML, pick a project and provider, preview, send. One-off mail without leaving the dashboard — marked with its own console source chip, because provenance matters.

Provider delivery, bounce, and complaint events correlate to their sends on the timeline — provider-accepted and delivered tracked as separate claims. Hard bounces land on per-project suppression lists enforced at send time, and a rescued-by-failover counter shows what the chain saved.

A create-a-team wizard — team, plan and payment, invitations — with self-serve Stripe checkout.

POST /v1/send with idempotency keys, 100-message batches, and a sandbox host where test keys can't send real mail. Why an API next to SMTP.

Registration with email verification, team invitations, a welcome wizard, password reset, TOTP + WebAuthn two-factor, and a per-user security log.

Production moved to dedicated servers in Falkenstein, Germany — the EU-metal home the platform runs on today (where everything runs).

The commitment to turn a private gateway into a product — starting with where it should live. A long evaluation of clouds versus dedicated hardware (outbound SMTP needs port 25, which most clouds restrict) ended with dedicated European metal, provisioned for the move that followed.