Zipper Mail

What it is

Zipper Mail (also called Zipper Email) is transactional email on Zipper’s own MTA. Add a domain, publish SPF (include:_spf.tinyzipper.com), DKIM, and DMARC, verify DNS, then send with POST /api/v1/email/send (all plans) or SMTP at smtp.tinyzipper.com:587 on Starter+. Messages are DKIM-signed on this Global Server node and relayed by Postfix. Attachments, batch, schedule, tags, webhooks, and one-click unsubscribe are built in. Inbound stores encrypted messages and routes to mailbox, webhook, or function. Webmail at mail.tinyzipper.com. Not a marketing blast tool — batches cap at 50 recipients per message.

Cloudflare analogue: Transactional ESP + inbound routing. SLA 99.9% · p99 90ms. Admins verify domains and mint keys. Operators may send tests and manage suppressions.

• ▸Domain verify: SPF + DKIM + DMARC wizard
• ▸HTTP API (zm_) on every plan · SMTP on Starter+
• ▸DKIM-signed outbound on Postfix
• ▸Send keys, SMTP credentials, and dashboard test send
• ▸Send log + suppressions
• ▸Inbound store + routes still included
• ▸Zipper Mail webmail + native app

How it works

Add a sending domain in Dashboard → Zipper Mail, or create a Zipper send address on mail.tinyzipper.com (display name + random local part).

Mint a zm_ send key. POST /api/v1/email/send — use use_hosted:true until your domain is verified, or from a verified custom domain.

Starter+ also gets SMTP: smtp.tinyzipper.com:587 STARTTLS with minted zs_ credentials (daily send caps by plan). Free stays API-only.

After a domain is verified, create company inboxes (john@yourdomain.com) or hosted @mail.tinyzipper.com; sign in at https://mail.tinyzipper.com or Zipper Mail (password shown once). Point MX @ → 10 mail.tinyzipper.com. so Zipper receives internet mail into those addresses.

Attachments, reply_to, tags, custom headers, scheduled_at, Idempotency-Key, batch (/api/v1/email/batch), and HTTPS webhooks are supported.

Pass template + vars for Zipper-branded auth/billing copy (logo + Powered by Zipper Email · Spatial Regal watermark). Free / hosted From always watermark; paid custom-domain sends can omit the footer. Batches max 50 recipients.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → Zipper Mail. Add domain → publish DNS → Verify → mint send key → create company or hosted inboxes → open mail.tinyzipper.com. Register delivery webhooks for bounce/complaint.

API

Control-plane: POST /api/v1/email/send · POST /api/v1/email/domains · POST /api/v1/email/inbound. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS https://tinyzipper.com/api/v1/email/send \
  -H "Authorization: Bearer zm_…" \
  -H "Content-Type: application/json" \
  -d '{"use_hosted":true,"template":"password_reset","to":["you@example.com"],"vars":{"name":"Alex","email":"you@example.com","action_url":"https://app.example/reset?t=…"}}'

curl -sS https://tinyzipper.com/api/v1/email/send \
  -H "Authorization: Bearer zm_…" \
  -H "Idempotency-Key: invoice-42" \
  -H "Content-Type: application/json" \
  -d '{"from":{"email":"billing@yourapp.com","name":"Billing"},"to":["cfo@corp.com"],"reply_to":"support@yourapp.com","subject":"Invoice","html":"<p>Attached</p>","tags":["invoice"],"attachments":[{"filename":"invoice.pdf","content":"BASE64…"}]}'

curl -sS -X POST https://tinyzipper.com/api/v1/email/mailboxes \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"local_part":"john","domain":"yourcompany.com","quota_mb":1024}'

const res = await fetch("https://tinyzipper.com/api/v1/email/send", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Verify SPF + DKIM before production sends. Publish DMARC at p=quarantine for BIMI inbox logos.

Host SVG Tiny PS at /.well-known/bimi.svg (or change BIMI l=). Gmail needs a VMC in a=.

SMTP submission (smtp.tinyzipper.com:587) is on Starter+. Free uses the HTTP API only.

Company inboxes need a verified domain; webmail is mail.tinyzipper.com (creation stays in the dashboard).

Keep List-Unsubscribe on for corporate inbox placement. Zipper Mail is transactional only.

• ▸SOC 2
• ▸AES-256-GCM
• ▸DKIM
• ▸SPF
• ▸DMARC
• ▸BIMI

Runbook

Add a sending domain, publish SPF include:_spf.tinyzipper.com, zipper._domainkey DKIM, _dmarc (quarantine for BIMI), and default._bimi, Verify, mint a zm_ send key (or Starter+ SMTP zs_ credential on smtp.tinyzipper.com:587), then POST /api/v1/email/send. Attachments, batch, schedule, tags, webhooks, and List-Unsubscribe are built in. After verify, create company inboxes (john@yourdomain) or hosted @mail.tinyzipper.com; open them at https://mail.tinyzipper.com. Point MX at mail.tinyzipper.com to receive. Host SVG Tiny PS at /.well-known/bimi.svg (Gmail needs a VMC).