Building Inbound Email Workflows: MX Routing, SPF/DKIM Parsing, and HMAC Webhooks
Build intelligent inbound email processing pipelines for customer support, AI agents, and receipt extraction using SendOFF Inbound MX routing.
Why Inbound Email Parsing is Hard
Handling incoming email programmatically has traditionally been painful:
SendOFF’s Inbound Email Engine handles all of this automatically. Incoming emails hitting our MX gateways are parsed, verified, and delivered to your webhook URL as clean, structured JSON payloads.
Configuring Inbound MX Records
To enable inbound routing on your subdomain (e.g. reply.yourdomain.com):
# DNS Record for Inbound Email
Host: reply.yourdomain.com
Type: MX
Priority: 10
Value: mx.sendoff.inOnce the DNS propagates, any email sent to anything@reply.yourdomain.com is parsed by SendOFF and posted to your registered webhook URL within 200ms.
Inbound JSON Payload Structure
Here is what SendOFF delivers to your webhook endpoint:
{
"event": "email.inbound",
"id": "inb_9f8a7b6c5d4e",
"from": {
"name": "Sarah Connor",
"email": "sarah.connor@cyberdyne.org"
},
"to": "support@reply.yourdomain.com",
"subject": "Question regarding workspace activation #ORD-98214",
"body_text": "Hello, can you clarify the overage billing thresholds?",
"body_html": "<p>Hello, can you clarify the overage billing thresholds?</p>",
"spam_score": 0.08,
"security": {
"spf": "pass",
"dkim": "pass",
"dmarc": "pass"
},
"received_at": "2026-10-20T03:30:00Z"
}Verifying Webhook HMAC Signatures
To ensure incoming webhook requests genuinely originate from SendOFF, verify the Svix-compatible HMAC signature header:
import { Webhook } from 'svix';
export async function POST(req: Request) {
const payload = await req.text();
const headers = {
'svix-id': req.headers.get('svix-id')!,
'svix-timestamp': req.headers.get('svix-timestamp')!,
'svix-signature': req.headers.get('svix-signature')!,
};
const wh = new Webhook(process.env.SENDOFF_WEBHOOK_SECRET!);
try {
const verifiedEvent = wh.verify(payload, headers);
console.log('Verified Inbound Email:', verifiedEvent);
return new Response('OK', { status: 200 });
} catch (err) {
return new Response('Invalid Signature', { status: 400 });
}
}With this setup, your application can reliably ingest, process, and act upon inbound customer emails with enterprise-grade cryptographic security.
Priya Nambiar
Engineering Lead at SendOFF. Specializing in bare-metal KumoMTA socket tuning, dual-lane deliverability infrastructure, and low-latency API systems.