Aria Mail: send and receive email from your app

Aria Mail lets your app send and receive email on a domain you own, with DKIM and SPF set up for you. You turn it on for an app, Aria makes the sending identity and the DNS records, and your services get the settings they need. Each workspace includes 2,000 emails a month, then each 1,000 costs £0.50. Aria Mail sends only from a domain that the app owns and that has been verified.

What does Aria Mail cost?

• 2,000 emails a month are included. The allowance is shared by every project in your workspace, so adding a project never adds to the 2,000.
• After that, £0.50 per 1,000. Each recipient of an email counts as one email.
• It is billed on your monthly invoice, as its own subscription, apart from your server plans. A month under 2,000 is a £0 invoice.
• Mail you receive is included up to 2,000 messages a month. Past that, each message counts as an email sent.
• You can set a monthly limit. The workspace’s Owner chooses a spending limit. Aria warns you at 80% and pauses sending at the limit.

Prices are in pounds. The plans are on pricing.

How do I turn it on?

1. Add the domain you want to send from. See Domains. The free address cannot send email.
2. Open your project, go to Email, and choose Turn on Aria Mail. Only an owner or admin can.
3. Pick the domain. You can also choose addresses to create, such as hello@, info@ or support@.
4. Aria makes the sending identity and the DNS records. If Aria runs your DNS, it adds them itself. Otherwise it shows each record to add where your DNS is managed.
5. Aria checks every 30 seconds and opens Aria Mail once the domain is verified.

The setup page shows four steps as they happen: the sending identity, the DNS records, verification and the addresses. If it stops, choose Try again, or Stop setting up to turn Aria Mail off for the app.

What does my app get?

Once the domain is verified, Aria sets these variables on the services that list them under env, without overwriting a value you set yourself or one that aria.yaml wires:

List them with required: false, because Aria fills them only after the domain is verified:

env:
  ARIA_MAIL_API_KEY:
    services: [web]
    required: false
  ARIA_MAIL_API_URL:
    services: [web]
    required: false
  MAIL_FROM:
    services: [web]
    required: false

Supabase Auth’s email is wired to Aria Mail automatically, unless you set auth.smtp yourself. See Self-hosted Supabase.

How do I send email over HTTP?

Post JSON to ARIA_MAIL_API_URL with the key as a Bearer token.

curl -X POST "$ARIA_MAIL_API_URL" \
  -H "Authorization: Bearer $ARIA_MAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"from":"hello@example.com","to":"you@example.org","subject":"Welcome","text":"Hello"}'

The answer is JSON with an id and a status. A key sends only for its own app, whatever the body says, and there is no way to send without a key.

How do I send email over SMTP?

Use SMTP_HOST, SMTP_PORT, SMTP_USER and SMTP_PASS. Aria Mail’s server listens on port 587 (STARTTLS) and port 465 (TLS). It refuses to sign in before the connection is encrypted, allows up to 50 recipients a message and applies the same From rule, limits and count as the HTTP API.

How do I receive email?

Each address you create can do any of these:

• Keep it in the inbox in the app’s Email page, where you can read, reply and forward.
• Forward it to another email address.
• Send it to your app as a signed POST to a webhook address you choose.

A webhook call carries an Aria-Signature header of the form t=<unix seconds>,v1=<hex>, where the value is an HMAC-SHA256 of <t>.<body> with your signing secret. Check it before you trust the call. Aria retries a failed call with a growing delay for 24 hours, calls only public https addresses and follows no redirects. Spam goes to a Spam folder and is never forwarded.

What keeps one app from hurting the rest?

• Rates. By default one app may send 14 emails a second and to 10,000 recipients a day.
• Reputation. If an app’s bounces pass 4% or its spam complaints pass 0.08% over seven days, Aria warns at half of that and pauses the app at the limit. The owner is emailed.
• The monthly limit. If you set one, sending pauses at it, for every project in the workspace.
• No open relay. Nothing is sent without an app’s key or login.

Aria Mail is for mail your app sends to its own users: receipts, sign-ins, resets and notices. Bulk marketing to bought lists is against the terms.

What if an app sends through another provider?

Keep it. Aria sets its Aria Mail variables only where you have not set your own. List your provider’s API key as a required secret, as in Environment variables.