Transmitly is transactional and permission-based marketing email on owned SMTP infrastructure. Durable acceptance, isolated streams, provider-aware rate control — and an autopilot that diagnoses, proposes and acts only within signed policy leases.
curl https://transmitly.io/v1/emails \
-H "Authorization: Bearer $TRANSMITLY_KEY" \
-H "Idempotency-Key: welcome-8f2c" \
-H "Content-Type: application/json" \
-d '{
"from": "Notify <[email protected]>",
"to": ["[email protected]"],
"subject": "Welcome to Acme",
"html": "<p>Your workspace is ready.</p>",
"stream": "transactional",
"tags": { "flow": "onboarding" }
}'
# 202 Accepted — after the transaction commits
{ "id": "msg_2f9c…", "status": "accepted" }accepted
committed
queued
scheduler
delivered
mx 250
Deferral pressure
autopilot reduced concurrency 30% · lease 60m
Controller decision
applied REDUCE_CONCURRENCY
provider=microsoft
evidence=fresh · tier=A1
expires automatically
01
Intake
Auth, quotas, ownership, MIME limits
02
Commit
Message + deliveries + outbox, one transaction
03
Schedule
Stream, pool, provider budget, fairness
04
Deliver
MTA adapter, KumoMTA spool, retries
05
Normalise
DSN/FBL events deduplicated and classified
06
Explain
Telemetry, incidents, proposals, signed actions
The platform
Most sending platforms optimise the dashboard. Transmitly optimises the invariants that keep email working: durable state, honest semantics, isolated reputation and auditable control.
Durable acceptance
Message, per-recipient deliveries, idempotency key and queue intent commit in a single Postgres transaction. A single-node failure cannot lose an accepted message.
Stream isolation
Transactional and marketing run on separate pools, budgets, priorities and blast-radius boundaries. Traffic is never laundered onto healthy IPs.
Observability
Every attempt is normalised into provider, MX, enhanced status and reason. Deferral pressure, bounce rate and complaint rate stay separate — no invented inbox score.
Bounded autonomy
DeepSeek proposes; a deterministic controller validates evidence freshness, bounds, scope and blast radius. Every change is a signed, expiring lease.
Autopilot
LLMs diagnose and propose. Deterministic controllers enforce suppression, quotas, pool isolation, rate limits and policy. If telemetry is stale, increases freeze and sending gets conservative — automatically.
Observe & propose
Always permitted. Summaries and recommendations only.
Reduce & pause
Automatic when deterministic triggers pass. Short leases, auto-expiry.
Scale & recover
Bounded within reserved capacity with rollback checks.
Expand privileges
Human approval. Caps, IP reassignment, DNS, suspensions.
Structured proposal
schema-validated{
"incident_id": "inc_2f91",
"scope": { "provider": "microsoft" },
"action": "REDUCE_CONCURRENCY",
"parameters": { "percent": 30, "duration_minutes": 60 },
"evidence_refs": ["provider_window:microsoft:15m"],
"confidence": 0.84,
"rollback_condition": "deferral rate < 5% for 30m",
"policy_version": "2026-11-v1"
}Rejected
Stale telemetry
telemetry older than 15m → freeze mutations
Rejected
Out-of-bounds lease
duration 900m > max 240m
Prompt-injection boundary
SMTP replies, customer HTML and tickets are untrusted data. They are delimited and summarised; they can never define tools, policies or authority.
Pilot access
Onboarding includes domain ownership, authentication checks, use-case review and graduated quotas. No purchased lists, no evasion, no unrestricted self-service sending.