Limits & quotas
Every limit Mailway enforces, and what happens when you reach it. Tier features and add-ons are on Plans & add-ons, and prices will be published at launch; this page is the engineering view.
Plan quotas
Section titled “Plan quotas”| Free | Pro | Team | Business | Enterprise | |
|---|---|---|---|---|---|
| Emails / month | 1,000 | 10,000 | 40,000 | 100,000 | custom |
| Emails / day | 100 | no cap | no cap | no cap | no cap |
| Throughput / month | 250 MB | 2.5 GB | 10 GB | 25 GB | custom |
| Retention | 30 days | 90 days | 180 days | 1 year | custom |
| Projects | 1 | 5 | 15 | unlimited | unlimited |
| Sender domains (team) | 1 | 10 | 75 | unlimited | unlimited |
| Sender domains per project | 1 | 2 | 5 | 10 | custom |
| Providers per project | 1 | 3 | 5 | unlimited | unlimited |
| Team members | 1 | 3 | 10 | 25 | custom |
When you hit them:
- Email volume — Free stops at the limit
(
402 monthly_quota_exceeded); every other plan keeps sending (soft overage) and the team email gets a notice at 80% and 100%. Soft overage is not billed during the private beta; how it is billed will be published with launch pricing. - Data volume (total message bytes) — the other plans get a grace margin
past the limit, then sends hold (
402 throughput_quota_exceeded) until the month rolls over, an add-on, or an upgrade; Free holds at the limit. - Free daily limit — additionally, Free sends at most 100
messages per UTC day (
429 daily_send_cap_exceeded). It limits abuse, is never billed, and resets at 00:00 UTC. - One Free team per person — the Free allowances
(monthly mails, the daily limit and the share link) belong to
the oldest Free team a person created. A newer Free team can be set
up and tested in the sandbox, but it can’t send real mail or create a share
link until it is on a paid plan (
402 free_team_limit; over SMTP,550). Accounts whose addresses differ only by dots count as one person. Upgrading or deleting the older team moves the allowances to the next one. - Quotas reset with the calendar month (UTC). Sandbox sends count toward nothing.
Message limits
Section titled “Message limits”| Limit | Value | Over it |
|---|---|---|
Recipients per message (to+cc+bcc) |
50 | 422 — split the audience or use batch |
| Subject | 998 characters | 422 (RFC 5322 line limit) |
html / text body |
2 MB each | 422 |
| Attachments per message | 20 | 422 |
| Single attachment (decoded) | 10 MB | 422 attachments:too_large |
| All attachments combined (decoded) | 25 MB | 422 attachments:total_too_large |
tags |
10 × 64 chars of [A-Za-z0-9_-] |
422 |
| Distinct tags per project | 1,000 for sends (reusing a tag always works; a rule’s tag action isn’t limited) |
422 tags:limit_reached |
metadata |
10 keys · 40-char keys · 500-char values | 422 |
Idempotency-Key |
12–40 chars of [A-Za-z0-9_-] |
422 |
| Batch elements per request | 100 | 422 |
scheduled_at horizon |
≥ now · ≤ 72 h ahead | 422 scheduled_at:too_soon / :too_late |
Mail arriving over the SMTP relay isn’t shaped by the API validator — but provider recipient caps still apply, which is where the over-cap fan-out takes over.
Rate limits
Section titled “Rate limits”| Surface | Limit | Keyed by |
|---|---|---|
| Send endpoint, authenticated | 600 requests / minute | your API key |
| Send endpoint, unauthenticated | 60 requests / minute | client IP |
| Batch endpoint, authenticated | 6 requests / minute | your API key |
| Batch endpoint, unauthenticated | 2 requests / minute | client IP |
Per-key (not per-IP) on purpose: tenants sharing an egress IP — NAT,
serverless — never throttle each other. Throttled requests get a 429
with a Retry-After header; back off and retry, with an
idempotency key so the retry can’t
double-send. A batch request counts once against the batch bucket
(6/min), and each accepted element counts against your quotas.
API stability
Section titled “API stability”The surface is versioned in the path (/v1/) and changes are
additive-only: new optional fields and new endpoints may appear;
existing fields, semantics, and error codes don’t change meaning within
v1. Branch on error.code, never on error.message.
Cookie consent
We may run ads on Google and Reddit. If we do, knowing whether they work needs your OK for one cookie each from them, used only to tie a signup back to the ad that brought it. Analytics here is cookieless either way, and declining changes nothing else.
Change your mind any time with "Cookie choices" in the footer. Details in the privacy policy.