How Vaartix protects deliverability
In short: Today Vaartix sends transactional email: login codes, password resets, receipts and account notifications. Marketing email is not supported yet, and unsolicited bulk email is never allowed. Every account is approved by a person before it can send, every sending domain must be verified, bounces and complaints are suppressed automatically, and accounts that go over our bounce or complaint limits are paused without waiting for anyone to notice.
1. Invite-only, with manual approval
Vaartix is in an invite-only beta. You can't sign up and start sending on your own:
- Each new team answers onboarding questions: company name, website, the kinds of email it will send, and expected monthly volume.
- A person on our team reviews every new account during the beta before it is approved.
- Accounts that plan cold outreach or unsolicited bulk sending are not approved, and neither are accounts that only want to send marketing or newsletters, which Vaartix doesn't support yet. See the Acceptable Use Policy.
2. Verified domains only
You can only send from a domain you have proven you control. Free mailbox domains (such as gmail.com) and domain names that imitate well-known brands are refused.
- DKIM: every email is DKIM-signed for your own domain. Vaartix uses its own 2048-bit RSA keys (Bring Your Own DKIM) published under the
vaartixselector, and a domain can't send until its DKIM record is verified. - SPF: each domain gets a custom MAIL FROM subdomain (
vx-bounces) with its own SPF and MX records, so SPF passes and aligns with your domain. - DMARC: we show every customer the DMARC record to publish and recommend one for every sending domain. With aligned DKIM and SPF, Vaartix email passes DMARC.
3. Automatic bounce and complaint handling
- Bounce and spam complaint notifications are processed as they arrive.
- Hard-bounced and complaining addresses are added to a suppression list automatically, and later sends to them are blocked. Customers can't work around this.
- Each account's bounce and complaint rates are measured over the last 7 days. Sending is paused automatically when the bounce rate goes above 4% or the complaint rate above 0.08% (once the account has sent at least 100 emails in that period). A paused account can't send again until we have reviewed it.
4. Rate limits and daily caps
- New accounts start at 100 emails a day. The daily limit grows in steps (100, 500, 2,000, 10,000, 50,000) by at most one step a day, and only when the account is using its limit with bounces under 2% and complaints under 0.05%. Going beyond 50,000 a day needs approval from a person.
- Each API key is limited to 10 requests per second, shared between the API and the SMTP relay.
- Monthly sending is capped by the account's plan.
5. Anomaly alerts
We are alerted when an account's volume suddenly jumps (for example, to ten times its normal daily volume), and when an account is paused for its bounce or complaint rate, so a person can look at it quickly.
6. Content checks
- Accounts that haven't been reviewed yet can't send links through URL shorteners, which are common in phishing.
- Risky attachment types, such as executables and scripts, are blocked for every account.
- Sender domains that imitate well-known brands are refused.
7. Bot protection and account security
- Dashboard sign-in and the forms on this website are protected by Cloudflare Turnstile, so bots can't create accounts or request login codes in bulk.
- Login codes are rate-limited per address. API keys are stored hashed and can be revoked at any time.
- The SMTP relay accepts connections only over TLS, requires an API key, and locks out repeated failed logins.
8. Marketing email (coming later)
Marketing email is on our roadmap but not available today. It will launch only with strict safeguards:
- Confirmed opt-in lists only.
- One-click unsubscribe (List-Unsubscribe / RFC 8058) on every message.
- Automatic suppression of unsubscribes, bounces and complaints.
- Separate sending infrastructure, so marketing email can't affect transactional deliverability.
Until then, marketing and promotional email must not be sent through Vaartix.
9. Infrastructure
Vaartix sends through Amazon Simple Email Service (Amazon SES), operated by Amazon Web Services, and stores customer data in the AWS Mumbai region (ap-south-1). See our Privacy Policy and Data Processing Agreement.
10. Reporting abuse
If you received unwanted email sent through Vaartix, forward it with full headers to [email protected]. We review every report, usually within one working day, and pause the sending account while we investigate a credible report.