Email relay

bash# API origin: https://cdn.vapp.vn

curl -sX POST https://cdn.vapp.vn/app/rpc/account/me \
  -H "authorization: Bearer $VAPPCDN_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"json":{}}'

# The {"json": …} envelope is required going IN as well as OUT.
# success: {"json": …}
# error:   {"json":{"code":"FORBIDDEN","status":403,"message":"…"}}

bashcurl -sX POST https://cdn.vapp.vn/app/rpc/mail/addDomain \
  -H "authorization: Bearer $VAPPCDN_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"json":{"domain":"send.example.com","brandDomain":"example.com"}}'

# → expectations: { dkimSelector, spfMechanism, dkimRecord }
#   Publish the selector WE return, not one you choose.

dnssend.example.com                       TXT  "v=spf1 a:mail.vappcdn.com ~all"
<selector>._domainkey.send.example.com TXT  "v=DKIM1; k=rsa; p=…"
_dmarc.example.com                     TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

# then, until status is "active":
POST /app/rpc/mail/checkDomain  {"json":{"domain":"send.example.com"}}

# Per-record status: ok · missing · invalid · unknown
# "unknown" means DNS did not answer us. It is NOT a failure — poll again.
# We check through a public resolver, never our own nameservers.

bashcurl -sX POST https://cdn.vapp.vn/app/rpc/mail/createCredential \
  -H "authorization: Bearer $VAPPCDN_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"json":{"domain":"send.example.com","name":"prod","localPart":"noreply"}}'

# → {"login":"noreply@send.example.com","secret":"…"}
# The secret is returned ONCE. There is no way to read it back.

bashcurl -sX POST https://cdn.vapp.vn/app/rpc/mail/send \
  -H "authorization: Bearer $VAPPCDN_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"json":{"from":"noreply@send.example.com","fromName":"Example",
               "to":["someone@example.org"],
               "subject":"Confirm your email",
               "text":"Confirm here: https://example.com/confirm?t=…"}}'

# → {"messageCount":1,
#    "outcomes":[{"to":"someone@example.org","status":"accepted","code":250}]}
#
#   accepted   we took responsibility for it — NOT the same as delivered
#   deferred   temporary; retry later, nothing is lost
#   refused    permanent; do not retry
#   suppressed never left the building (suppression list, or an unverified domain)
#
# Each recipient gets its own message: we never put several addresses on one
# To:, which would disclose your recipient list to everyone on it.

bash# catch-all: everything at the domain lands in one mailbox
POST /app/rpc/mail/addForward
  {"json":{"domain":"example.com","kind":"catchall","destEmail":"you@example.net"}}

# one address
POST /app/rpc/mail/addForward
  {"json":{"domain":"example.com","kind":"external",
           "source":"support","destEmail":"team@example.com"}}

# Forwarded mail is re-sent by us, so the envelope sender is rewritten. You do
# not configure that; it is what keeps SPF passing at the final destination.