# SMTP relay (https://coss.com/products/smtp)

> coss.com's SMTP relay sends email from anything that speaks SMTP, with an API key as the password and the same checks, tracking and webhooks as the API.

## How it works

Point your app's mail settings at smtp.coss.com and log in with an API key. Each message becomes an API send.

| Setting  | Value                                                        |
| -------- | ------------------------------------------------------------ |
| Host     | `smtp.coss.com`                                              |
| Port     | `465` (TLS) or `587` (STARTTLS); `2465` and `2587` also work |
| Username | `coss`                                                       |
| Password | An API key (`coss_live_…` or `coss_test_…`)                  |

```ts
import nodemailer from "nodemailer";

const transport = nodemailer.createTransport({
  host: "smtp.coss.com",
  port: 465,
  secure: true,
  auth: { user: "coss", pass: process.env.COSS_API_KEY },
});

await transport.sendMail({
  from: "Acme <hello@acme.com>",
  to: "ada@example.com",
  subject: "Welcome",
  html: "<p>Thanks for signing up.</p>",
  headers: { "X-Coss-Category": "onboarding", "X-Coss-Idempotency-Key": "welcome-user-123" },
});
```

The key decides where the email goes, exactly as with the API: a sandbox key sends nothing out of
coss.com, a live key sends from a [verified domain](/docs/email/domains). A `250` reply names the
email's id (`250 2.0.0 OK queued as email_01…`), which `coss.email.get()` looks up.

## One pipeline, two protocols

The relay is never a raw passthrough. Every message goes through the same send path as the API.

### Same checks as the API
Each message becomes a [`POST /v1/emails`](/docs/api-reference/emails/send-email) request: sender authorization, suppressions, quotas, content screening, tracking, webhooks and billing all apply. Messages appear in the environment's [logs](/docs/logs) with source `smtp`, without addresses or content.

### API keys, not passwords
Log in as `coss` with an API key that can send email. The key is checked again on every message, so revoking it or suspending the organization stops even a connection held open for hours.

### X-Coss-* headers
[Headers](/docs/email/smtp#cosscom-headers) set the API's fields: `X-Coss-Category`, `X-Coss-Tags`, `X-Coss-Tracking`, `X-Coss-Scheduled-At`, `X-Coss-Idempotency-Key` and `X-Coss-Subaccount`. coss.com reads them and never sends them on.

### Bcc stays private
The envelope decides who receives a message. `To` and `Cc` headers stay visible, every other envelope recipient becomes `bcc`, and coss.com never moves a Bcc'd address into a visible header.

### Replies that say what to do
`4xx` replies where a retry can help, such as a used-up quota; `5xx` where it can't, such as an unverified sender. With `X-Coss-Idempotency-Key`, a client's retry after a dropped connection gets the first email back.

### Framework recipes
Settings for [nodemailer, Better Auth, Supabase, WordPress, Rails, Laravel and Django](/docs/email/smtp#frameworks). Rails, Laravel and Django can also send over HTTPS with coss.com's own [drivers](/docs/integrations).

## Specifications

What the relay accepts. The docs list each one in context.

- Host: smtp.coss.com
- Implicit TLS: 465, or 2465
- STARTTLS: 587, or 2587
- Authentication: PLAIN or LOGIN, after TLS only
- Username: coss
- Recipients per message: 50
- Message size: 40 MB
- Custom headers sent on: 15
- Attachments: 20 files, 25 MB combined

## Pricing

Email sent over SMTP is billed per recipient, like any email.

| Product | Rate | |
| --- | --- | --- |
| Email | $0.40 per 1,000 recipients for the first 1,000,000; $0.30 per 1,000 recipients from 1,000,001 to 10,000,000; $0.22 per 1,000 recipients beyond 10,000,000 | |

Free includes 3,000 email recipients a month. See [pricing](/pricing) for the plans.

## Frequently asked questions

### What are coss.com's SMTP settings?

Host smtp.coss.com, port 465 for TLS from the first byte or 587 for STARTTLS, username coss, and an API key as the password. If your host blocks outgoing 465 and 587, ports 2465 and 2587 work too.

### Is email sent over SMTP treated differently from the API?

No. Each message becomes the same request as POST /v1/emails, so it gets the same sender checks, suppressions, quotas, tracking, webhooks and logs, and shares its API key's rate limit and the organization's send quotas with API sends.

### How do I use coss.com as the SMTP server for Supabase Auth?

In the Supabase dashboard, open Authentication, then Emails, then SMTP Settings, and turn on custom SMTP with host smtp.coss.com, port 465, username coss, a live API key as the password, and a sender address on your verified domain.

### Can I set a category, tags or a schedule over SMTP?

Yes. The X-Coss-Category, X-Coss-Tags, X-Coss-Tracking, X-Coss-Scheduled-At, X-Coss-Idempotency-Key and X-Coss-Subaccount headers set the API's fields. coss.com reads them and never sends them on.

### Does the SMTP relay support Bcc?

Yes. The envelope decides who receives a message, and envelope recipients not named in the To or Cc headers become Bcc. coss.com never moves a Bcc'd address into a visible header, so a message with no To recipient is refused.

### Can I send without TLS?

No. Authentication is refused before TLS, so use port 465 for implicit TLS or 587 with STARTTLS.