SMTP relay
Send emails over authenticated SMTP without ever seeing the provider behind Publiq — same send pipeline and observability as the HTTP API.
If your system already speaks SMTP — a legacy ERP, a tool that only knows how to send via smtplib/nodemailer, an old script you'd rather not rewrite — you don't need to migrate to the HTTP API to use Publiq. The SMTP relay is an ingress that accepts authenticated SMTP connections and feeds every message into the same send pipeline used by emails.send — queue, rendering, delivery and all the observability events (sent, delivered, opened, clicked, bounced). Publiq never exposes which delivery provider sits behind it: to your SMTP client, there's only smtp.publiq.digital.
This is not an open relay. Every connection must authenticate with AUTH — there is no anonymous send path.
Ports: 587 (STARTTLS) or 465 (implicit TLS)
The relay listens on two ports, both encrypted:
- 587 — submission with STARTTLS. The connection starts in plaintext and upgrades to TLS before
AUTH. This is the default port for most modern SMTP libraries. - 465 — implicit TLS. The connection is encrypted from the initial handshake, with no upgrade step. Prefer this port if your client/library supports implicit TLS directly.
Pick whichever is easier to configure in your client — send behavior is identical on both.
AUTH is only accepted once the channel is encrypted (STARTTLS or implicit TLS). There is no plaintext fallback — authenticating before TLS is rejected.
Authentication
The relay accepts AUTH PLAIN or AUTH LOGIN. The username can be anything (it isn't checked) — what actually authenticates you is the password, which must be a Publiq API key with send-only scope. This mirrors the SMTP-relay convention used by SendGrid and Mailgun, so if you've integrated with either before, the setup will feel familiar.
Example configuration for a generic SMTP client:
Host: smtp.publiq.digital (check the exact host in your dashboard — smtp.publiq.digital is illustrative)
Port: 587 (STARTTLS) or 465 (implicit TLS)
Username: anything (e.g. "publiq")
Password: postly_sk_... (your API key with send-only scope)The sender (from) and recipients (to) are read directly from the SMTP protocol's MAIL FROM / RCPT TO commands, not from MIME headers. Subject, body (text/HTML) and attachments come from the message body as usual.
Two restrictions to keep in mind:
- Maximum message size: 25 MB. Larger messages are rejected before entering the pipeline.
- The API key must have
send-onlyscope. Keys withfullorread-onlyscope are rejected with an authentication error (SMTP 535) — no other scope is accepted by the relay.
See also
emails.send— the same send pipeline, with more control (templates, variables, idempotency).- Errors, idempotency and retries — how to interpret failures and avoid duplicate sends.