Runs examples for real against your account. Test keys only; kept in this tab, never stored on our side. Get a key
ZapSMTP / Docs / Guides

SMTP relay

Point any application, CMS or mail library at ZapSMTP. SMTP and the API share one pipeline: the same email log, events, webhooks, suppressions and limits.

Settings
Hostzapsmtp.xyz
Ports587 or 2525 with STARTTLS, 465 with TLS
EncryptionTLS 1.2 or newer. Authentication is refused on an unencrypted connection.
AuthenticationPLAIN or LOGIN
Limits40 MB per message, 50 recipients per message

Credentials

Create an SMTP credential for each application in the dashboard or with the API. Its username looks like smtp_k3f9x2m7q1ab and it has its own password, shown once. Credentials can only send; they never work with the HTTP API, and you can revoke one without touching the others.

An API key also works as the password with any username that does not start with smtp_ (for example zapsmtp). Test keys work too: the message runs the whole pipeline and is not delivered.

Choose the stream per message with the header X-Zap-Stream: broadcast (default transactional).

Turn reply tracking on or off for one message with X-Zap-Reply-Tracking: on or off; without the header the From domain’s default applies. Any other value is refused with 550 5.6.0.

Send over SMTP
import nodemailer from 'nodemailer';

const transport = nodemailer.createTransport({
  host: 'zapsmtp.xyz',
  port: 587, // STARTTLS
  auth: { user: process.env.ZAP_SMTP_USER, pass: process.env.ZAP_SMTP_PASSWORD },
});

await transport.sendMail({
  from: 'Acme <hello@acme.com>',
  to: 'delivered@simulator.zapsmtp.xyz',
  subject: 'Hello over SMTP',
  html: '<p>It works.</p>',
});
ZAP_SMTP_USER and ZAP_SMTP_PASSWORD come from your SMTP credential.

Reply codes

250 after DATA means the message was accepted, not delivered; delivery results arrive as webhook events. A 4xx reply is temporary: your mailer keeps the message and retries. A 5xx reply is permanent: retrying the same message fails the same way.

SMTP replies
550 5.6.0permanentThe message failed validation (for example an unparsable From, a bad header or attachment); the reply says what.
550 5.7.1permanentThe From domain is not verified, the credential or key is restricted to another domain or to another stream, or the account is suspended.
550 5.1.1permanentEvery recipient is on your suppression list: nothing is sent.
535 5.7.8permanentAuthentication failed, or the credential was revoked or expired after you logged in (Credentials no longer valid).
451 4.7.0temporaryOver your per-second rate limit.
452 4.2.2temporaryMonthly or daily quota reached. The mailer keeps retrying, but nothing goes out until the quota resets or your plan changes.
452 4.5.3temporaryMore than 50 recipients in one message. The extra recipients are refused; send them in another message.
451 4.3.1temporaryServer busy: too many large messages in flight.
451 4.3.0temporaryOverloaded, the MTA is briefly unavailable, or an internal error. Retry shortly.
454 4.7.0temporaryToo many failed logins from your IP (20 in 10 minutes), a temporary authentication failure, or Account moved: your account is served by another cell, named with its URL in the reply. Point the mailer at that host.