Share links & proof of delivery

Because Mailway archives every message byte-for-byte, it can show a third party exactly what was sent, and prove it. Two features build on that archive: support teams use the first every day; legal, finance, and compliance teams use the second.

Share links

Any archived mail can be shared as a link on mailway.to — no Mailway account needed to view it:

https://mailway.to/m/<token>

• Expiring by design — you pick 1 hour up to 4 days; the default is 1 hour. Links can be revoked early, and every creation and revocation is recorded in the team’s security history.
• Optionally password-protected — choose require a password when you create the link, and Mailway generates an access password that is shown once.
• Complete — the viewer shows the rendered mail plus its text part, headers, attachments, and the raw source, with the message’s own SHA-256 fingerprint. It serves the archived message as Mailway received it (byte-for-byte apart from the automatic exceptions made on receipt), not a copy fetched back from the recipient’s server. The recipient’s copy is your provider’s version of it: providers change headers, and some change the body (Brevo adds a tracking pixel), as tested in What providers change.
• Safe — the mail renders in a sandbox on a separate cookie-less domain; customer HTML can’t run scripts, and share pages are no-referrer + noindex.

On the Free plan, a share link has limits: see Availability.

Use it for “can you check what we sent my customer?”: instead of screenshots and forwarded copies, send the mail itself.

To create one, open the mail in the console, go to Share & certify this mail, pick how long the link lasts, and choose Create link.

Proof-of-delivery certificates

A share link shows a mail; a certificate proves it. For an archived, provider-accepted mail, Mailway can issue a tamper-evident certificate binding together:

1. the message content (SHA-256 of the exact bytes),
2. the provider handoff (the provider’s message id and acceptance time; the provider is named on each delivery event),
3. confirmed delivery, where delivery events exist (provider-attested),
4. Mailway’s own Ed25519 signature over the evidence (Ed25519 is a standard digital-signature algorithm),
5. an RFC 3161 timestamp from an independent time authority (RFC 3161 is the standard for trusted timestamps), countersigning that signature — the certificate provably existed when it says it was issued, and can’t be back-dated. Not even by Mailway.

The timestamp proves when the certificate was issued, which can be long after the mail was sent. It doesn’t date the send. What the certificate says about the send comes from Mailway’s record of that mail and from the providers’ own reports: the message hash is computed from Mailway’s archived copy when the certificate is issued, the acceptance time is when Mailway recorded the provider’s handoff, and delivery times are the provider’s own.

To issue one, open the mail in the console, go to Share & certify this mail, and choose Issue certificate. You can also attach a certificate to a share link when you create it.

Certificates verify offline — a relying party never has to reach Mailway’s servers. A certificate attached to a share link is checked right in the reader’s browser, and the downloaded .json carries everything — evidence, signature, public key, timestamp token. It keeps verifying with this Node.js check, which uses only Node’s built-in crypto and prints VALID or INVALID. Paste it as is: it runs in bash, zsh, and fish. The console shows the same check, as one line, next to the certificate.

node -e '
const crypto = require("crypto");
const fs = require("fs");

// The certificate: signed document, signature, public key.
const cert = JSON.parse(fs.readFileSync(process.argv[1]));

// An Ed25519 public key in DER (SPKI) form:
// a fixed 12-byte header, then the 32 raw key bytes.
const key = crypto.createPublicKey({
  key: Buffer.concat([
    Buffer.from("302a300506032b6570032100", "hex"),
    Buffer.from(cert.public_key, "base64"),
  ]),
  format: "der",
  type: "spki",
});

const ok = crypto.verify(
  null,
  Buffer.from(cert.document),
  key,
  Buffer.from(cert.signature, "base64"),
);

console.log(ok ? "VALID" : "INVALID");
' mailway-certificate.json

The timestamp is verifiable with standard openssl ts, even in an air-gapped environment. The check proves the certificate is intact and was signed by the key it carries. Mailway doesn’t publish its signing key yet, so this check alone doesn’t prove who issued the certificate.

What a certificate claims

A certificate states exactly what it can prove: accepted (provider handoff) or delivered (event-confirmed receipt). It never inflates one into the other. And where Mailway itself re-encoded the message (the opt-in for structured-only API providers), no certificate is issued at all — byte equality wasn’t preserved, so it isn’t certified. Plain share links remain available. Mailway is not a qualified trust service under the EU’s eIDAS regulation: a certificate is not a qualified electronic registered delivery service, and its timestamp is not a qualified electronic timestamp. How much weight a certificate carries in a dispute is for whoever relies on it, such as a court, to decide.

Availability

Share links are available on Pro plans and up; certificates on Business and up. Creating either needs the Admin, Developer, or Member role (not the Finance role), and is recorded in the team’s security history. Both follow the mail’s retention window: a link is revoked when the content it exposes is removed, while an already-issued certificate keeps verifying offline after the content is gone.

The Free plan has 1 share link per calendar month (UTC), so you can try it. That link has limits:

• it lasts up to 24 hours;
• it works only for a mail a provider accepted (a sandbox capture qualifies only after Release from sandbox with a real send);
• it can’t have a password or a certificate;
• its page shows the rendered mail, its text, and its headers, but not the attachments or the raw source, and it says the link was shared from a free account, with a link to report it.

A revoked link still counts toward the month. The page follows the team’s current plan: after an upgrade to Pro, an existing link shows everything; after a move to Free, existing links show the limited page.