Evolve Inbox

Why I built it

EvolveTech needed an inbox for its own domain: a place to receive service messages and read them in a browser. A small receiving app was enough. Forward Email handles SMTP and posts parsed messages to a webhook; a Netlify Function stores them and serves the reader.

Try the reader

The public demo uses the same reader UI with three fictional messages. Open formatted mail, switch to plain text, download the sample attachment and inspect a failed sender check. It is read only and makes no requests to the real mailbox.

How mail arrives

A domain alias or catch-all points to a private webhook URL. Each delivery becomes a message object in site-wide Netlify Blobs storage, with a separate inbox index. The browser authenticates to the message API with the inbox password. The webhook has its own independent secret.

The forwarding rule is encrypted before it is published in DNS, keeping the webhook secret out of public TXT records. Provider accounts, deployment secrets and mailbox contents are not included in the repository.

What the reader does

• Formatted HTML mail opens in a sandboxed frame with a policy that blocks scripts and remote images. A plain-text view remains available.
• Attachments download directly from the authenticated message. SPF, DKIM and DMARC badges show the results reported by the forwarding provider.
• The layout adapts from a two-column desktop reader to a message list and reader on a phone. It follows the device's light or dark theme.

Run your own

The deployment guide covers Netlify settings, independent reader and webhook secrets, Forward Email routing, encrypted TXT records and a real delivery check. The repository includes tests, a static demo builder and a sample Netlify deployment. Hosting and forwarding depend on the providers you choose.

Scope and limits

This is a receiving inbox for one owner. Sending, SMTP submission, IMAP, POP3, multiple accounts, a second factor and search are not implemented. Messages are not end-to-end encrypted; the forwarding and hosting accounts can access them.

The index lists the newest 2,000 messages. There is no automated retention, and the simple shared index can race during simultaneous deliveries. Tests cover access checks, webhook delivery, message retrieval, attachments and deletion; browser checks exercise the reader, mobile layout and isolation of untrusted HTML.