coss.com

SMTP for everything that can't call an API.

coss.com's SMTP relay sends email from anything that speaks SMTP, with an API key as the password and the same checks, tracking and webhooks as the API.

Read the docs

How it works

Point your app's mail settings at smtp.coss.com and log in with an API key. Each message becomes an API send.

import nodemailer from "nodemailer";

const transport = nodemailer.createTransport({
  host: "smtp.coss.com",
  port: 465,
  secure: true,
  auth: { user: "coss", pass: process.env.COSS_API_KEY },
});

await transport.sendMail({
  from: "Acme <hello@acme.com>",
  to: "ada@example.com",
  subject: "Welcome",
  html: "<p>Thanks for signing up.</p>",
  headers: { "X-Coss-Category": "onboarding", "X-Coss-Idempotency-Key": "welcome-user-123" },
});

The key decides where the email goes, exactly as with the API: a sandbox key sends nothing out of coss.com, a live key sends from a verified domain. A 250 reply names the email's id (250 2.0.0 OK queued as email_01…), which coss.email.get() looks up.

One pipeline, two protocols

The relay is never a raw passthrough. Every message goes through the same send path as the API.

Same checks as the API

Each message becomes a POST /v1/emails request: sender authorization, suppressions, quotas, content screening, tracking, webhooks and billing all apply. Messages appear in the environment's logs with source smtp, without addresses or content.

API keys, not passwords

Log in as coss with an API key that can send email. The key is checked again on every message, so revoking it or suspending the organization stops even a connection held open for hours.

X-Coss-* headers

Headers set the API's fields: X-Coss-Category, X-Coss-Tags, X-Coss-Tracking, X-Coss-Scheduled-At, X-Coss-Idempotency-Key and X-Coss-Subaccount. coss.com reads them and never sends them on.

Bcc stays private

The envelope decides who receives a message. To and Cc headers stay visible, every other envelope recipient becomes bcc, and coss.com never moves a Bcc'd address into a visible header.

Replies that say what to do

4xx replies where a retry can help, such as a used-up quota; 5xx where it can't, such as an unverified sender. With X-Coss-Idempotency-Key, a client's retry after a dropped connection gets the first email back.

Framework recipes

Settings for nodemailer, Better Auth, Supabase, WordPress, Rails, Laravel and Django. Rails, Laravel and Django can also send over HTTPS with coss.com's own drivers.

Specifications

What the relay accepts. The docs list each one in context.

Host
smtp.coss.com
Implicit TLS
465, or 2465
STARTTLS
587, or 2587
Authentication
PLAIN or LOGIN, after TLS only
Username
coss
Recipients per message
50
Message size
40 MB
Custom headers sent on
15
Attachments
20 files, 25 MB combined

Pricing

Email sent over SMTP is billed per recipient, like any email.

Free includes 3,000 email recipients a month. See pricing for the plans.

Questions

What are coss.com's SMTP settings?
Host smtp.coss.com, port 465 for TLS from the first byte or 587 for STARTTLS, username coss, and an API key as the password. If your host blocks outgoing 465 and 587, ports 2465 and 2587 work too.
Is email sent over SMTP treated differently from the API?
No. Each message becomes the same request as POST /v1/emails, so it gets the same sender checks, suppressions, quotas, tracking, webhooks and logs, and shares its API key's rate limit and the organization's send quotas with API sends.
How do I use coss.com as the SMTP server for Supabase Auth?
In the Supabase dashboard, open Authentication, then Emails, then SMTP Settings, and turn on custom SMTP with host smtp.coss.com, port 465, username coss, a live API key as the password, and a sender address on your verified domain.
Can I set a category, tags or a schedule over SMTP?
Yes. The X-Coss-Category, X-Coss-Tags, X-Coss-Tracking, X-Coss-Scheduled-At, X-Coss-Idempotency-Key and X-Coss-Subaccount headers set the API's fields. coss.com reads them and never sends them on.
Does the SMTP relay support Bcc?
Yes. The envelope decides who receives a message, and envelope recipients not named in the To or Cc headers become Bcc. coss.com never moves a Bcc'd address into a visible header, so a message with no To recipient is refused.
Can I send without TLS?
No. Authentication is refused before TLS, so use port 465 for implicit TLS or 587 with STARTTLS.

Works with

On the same key, SDK, webhooks and logs: nothing more to set up.

Compared

How it stacks up against the services you may be using, with sources.

Start with SMTP relay today.

Development keys record every request and event and deliver nothing, so you can build and test before you verify a domain. Hand your coding agent this prompt:

Add coss.com to this project: read https://coss.com/llms.txt, get a development key with `npx coss-cli init --agents`, and build and test with it.

Pricing