Changelog

If your product emails a company about that company, our abuse filter could read it as an attempt to impersonate them and refuse the send with a content_flagged error. A job application naming the employer, a sales enquiry naming the prospect, an invoice naming the client, a sign-in link sent to your own second domain: all of them were caught this way. In the worst cases the account was suspended automatically rather than the single message being rejected.

The filter is there for a real attack, where someone emails a company’s staff while posing as that company. The mistake was treating any mention of the recipient’s name as that claim. Naming a company in your subject line is simply what mail addressed to that company looks like. And a business that runs more than one domain was only ever compared against the one it happened to send from, so its own second domain looked like a stranger’s.

Three things have changed. Only the sender name can establish a claim of identity now, so naming a company in a subject line no longer counts against you by itself. Every domain on your project is recognised as yours, not only the one a given message was sent from. And a word that two companies merely happen to share is no longer read as an identity.

Suspending an account also takes more than one signal now. A questionable message is still refused, but switching off an account waits for a second signal to agree, because a wrong refusal costs you one email while a wrong suspension costs you your whole service.

Before releasing this we replayed it over every message sent through SendByte in the last thirty days, to confirm it gives up no protection that real traffic depends on. If you were blocked or suspended by this, your account has already been put right and you will have heard from us directly.

Starting a campaign from scratch left you with an editor that would not accept anything. Clicking “Add to the end” opened the list of parts, and choosing Heading, Text, Button or any of the others simply closed the list again. Nothing appeared, and no error explained why. Starting from one of the templates worked normally, so the problem only showed up if you wanted to write your own email from an empty page.

A campaign holds its design as a document, and each part you add is placed inside that document. A campaign begun from scratch has no document yet, and the editor had nowhere to put the first part, so it quietly did nothing rather than saying so.

The first part you add now creates the document it needs, and everything after it lands where you would expect. If you tried to build a campaign this way and gave up, it will work now. Campaigns you had already started from a template were never affected, and no saved work was lost.

Adding a picture to a campaign used to mean finding somewhere to host it first, then coming back and pasting the web address. You can now upload the image where you need it. Click to choose a file or drop one onto the image block, and it goes straight into the email.

The address field is still there and still editable, so if you already host your images somewhere you can carry on pasting links exactly as before.

Two things worth knowing. SVG files are turned away on purpose: Gmail and Outlook do not display them in email, so the picture would simply be missing for most of the people you send to. Export as PNG instead. And if you upload something far larger than an email needs, we will say so, because a heavy image makes your message slower to open without looking any better.

Uploads are limited to 5 MB, and PNG, JPG and GIF all work.

Occasionally, moving between dashboard pages would land you on a screen of unreadable code with a URL ending in index.txt. Going back and clicking again always worked, which made it easy to dismiss and hard to pin down.

The cause was a dropped request. When the dashboard loads a page, it fetches that page’s data separately from the page itself. If that one request failed, from a brief loss of signal, a sleeping tab waking up, or a deploy landing mid-click, the dashboard fell back to a full page load but pointed the browser at the data file rather than the page. Your browser did what it was told and showed you the file.

The fallback now sends you to the page, so a dropped request costs you a reload instead of a wall of code. Nothing was ever wrong with your account or your data.

Now that campaigns are live, the pricing page spells out what that means for your bill: nothing changes. Marketing email is included on every plan, including Free. Campaigns, lists, segments, signup forms and automation are all there, with no add-on and no second subscription.

What your plan sets is how much audience you can hold. Free covers 1 brand and 500 subscribers, Startup 2 brands and 2,000, Starter 3 and 10,000, Growth 10 and 50,000, and Scale has no limit on either. Those numbers have always been in place; they are now published on the pricing page and shown on the plan cards in your dashboard, so you can see the ceiling before you reach it.

Campaign sends draw from the same monthly email quota as your transactional mail. One email to one subscriber is one email, exactly as it is on the API, so a 5,000-recipient campaign uses 5,000 of your quota and bills at your normal overage rate beyond it. One quota, one bill, both channels.

You can now send newsletters and campaigns from SendByte, alongside the transactional email you already send. Look for Marketing in the dashboard.

Everything lives inside a brand: your lists, your subscribers, your templates, your campaigns and your reports. If you run more than one product or client, each gets its own brand with its own sending domain and its own audience, kept completely separate.

Lists come with the parts you would expect: single or double opt-in, custom fields, segments built from dropdowns rather than typed conditions, a hosted subscribe form, and autoresponders that go out when someone joins or on a date you choose. Housekeeping shows you what it will remove before it removes it.

Campaigns start from a template rather than a blank page. Pick one from the store, then edit the actual parts of it, the headline, the words, the picture, where the button points, with the real email rendered beside you as you type. If you would rather write the markup yourself, MJML and plain HTML both work.

Your campaigns will not damage your transactional sending. Marketing leaves through a completely separate sending reputation from your receipts, password resets and alerts. A newsletter that collects complaints cannot drag down the mail your product depends on. That separation is infrastructure, not a policy we promise to enforce.

Every campaign carries an unsubscribe link whether you add one or not, and unsubscribes, bounces and complaints are processed for you and reflected on your lists automatically.

Coming from Sendy? The suite is built around the same shape, so most of what you know transfers. Paste a Sendy template and we will spot its tags and offer to convert them in one click. There is a migration guide in the docs covering what maps to what and the handful of things that behave differently.

To send marketing from a domain, add two extra DNS records shown in your brand settings. Your campaigns will go out without them, but adding them puts your own domain in the “mailed by” line inboxes show, instead of ours.

If your account carries a discount that covers a plan’s whole monthly fee, there is nothing to pay, so we activate the plan for you rather than sending you to a payment page. The upgrade screen did not handle that case. It tried to send you to a checkout that was never created, and you landed on an error page even though your plan had in fact been activated.

The upgrade screen now recognises this and confirms it clearly: it tells you the plan is active, that your discount covered it in full, and that no card was charged.

If you hit this before, your upgrade did go through and you were not charged. Your plan has been active the whole time. You can check it on the Billing page.

When we review an account and mark it trusted, that is meant to be the end of our second-guessing your content. It was not quite. Three checks still applied to trusted accounts, and one of them, our check for a sender posing as the recipient’s own organisation, catches something that legitimate software does all day: naming the customer in the subject line. An invoice reading Invoice INV-2041 from Acme for Northline Logistics, sent to someone at Northline, looked the same to the filter as a message pretending to be Northline. Sends like that were rejected with content_flagged even though the account was trusted.

Trusted accounts are no longer content-filtered at all. Every signal is still scored and recorded on the email so you can see it in your log, and it is still visible to us, but nothing about the wording of your message can stop it from being sent.

This does not weaken anything for other accounts. The filter is unchanged for everyone who has not been individually reviewed, and the protections that matter most, sending limits, reputation monitoring, and suppression enforcement, apply to every account including trusted ones. Those watch how an account behaves rather than how it writes, which is the right way to catch a problem without punishing normal transactional mail.

If your sends are being rejected for content that you know is legitimate, contact support and ask us to review the account.

You can now embed an image inside the body of an email instead of sending it as a download. Give the attachment a content_id and reference it from your HTML:

"html": "<img src=\"cid:logo\" width=\"120\" alt=\"Acme\">",
"attachments": [
  { "filename": "logo.png", "content": "iVBORw0KGgo...", "content_type": "image/png", "content_id": "logo" }
]

We compose the message as multipart/related with a Content-ID header on the inline part, which is how Gmail, Outlook, Apple Mail and Thunderbird resolve a cid: reference. Attachments without a content_id stay ordinary downloads, so one message can carry an embedded logo and an attached invoice.

If your HTML points at a cid: that no attachment provides, the send is now rejected and tells you which reference is unmatched, rather than delivering an email with a broken image.

Sending through the SMTP relay needs no changes at all, and it works better than before: inline images composed by your mail client or library previously lost their Content-ID on the way through, so they arrived as a plain attachment next to a broken image. They now come through intact.

Inline images count against the ten-file and message-size limits, so a hosted https image is still the better choice for anything large or anything you may want to swap out after sending.

The email log now shows the files that went out with a message. Open any email and you will see each attachment with its type and size, plus a download link, so you can check exactly what a recipient received without digging through your own code.

Inline images render properly in the preview too. Until now the log displayed the raw message body, so an image embedded with a cid: reference showed as broken even though the delivered email was correct. Inline images are labelled and show their Content-ID, which is the thing to compare against your HTML when a preview does not look the way you expect.

Download links are signed and short-lived, so they expire a few minutes after you open the email. Reopening it gives you a fresh link. Attachments are stored for 30 days, so a download link is only available for mail sent inside that window.

Our abuse filter checks whether a link’s visible text matches where the link actually goes, because a mismatch is a classic phishing tell. It was too strict. If your email showed your own domain as the link text but pointed at your app on a different host, for example text reading acme.io/r/abc linking to acme-app.fly.dev, the message was rejected with content_flagged. That is normal product mail, and it was blocking real sends.

A domain shown in link text now only counts against you when it belongs to neither the link’s destination nor your own sending domain. Displaying your own domain is fine. Genuine phishing, where a message displays someone else’s domain and links somewhere unrelated, is still blocked exactly as before.

We also stopped mistaking three things for domains in link text: file names such as invoice-July.pdf, email addresses, and version numbers such as v1.2.10. Any of those could previously trip the check on its own.

If a message of yours was ever rejected for this, it will now go through. Nothing about your setup needs to change.

If your mailer holds one authenticated SMTP connection open and sends many messages through it, as Symfony Mailer, Nodemailer and most connection pools do, that now works properly. Our relay was closing idle connections after 30 seconds, so the next message on a reused connection failed with a 421 timeout. The idle limit is now 5 minutes, which is what the SMTP standard asks for, and NOOP keepalives work if you want to hold a connection open indefinitely.

The limits that govern an SMTP session are now written down in the SMTP guide: idle timeout, time allowed to authenticate, messages per connection, recipients per message, and message size. If you pool connections, that page tells you exactly what to configure.

We also fixed a fault that stopped pay-as-you-go sends over SMTP. If your account used up its included monthly sends, the charge against your wallet balance was failing, so those sends were rejected even with a funded wallet and pay-as-you-go switched on. Sends through the API were never affected. This is fixed, and sending now draws on your wallet as it should.

Two smaller improvements in the same release. Deploys no longer interrupt messages that are mid-transmission: the relay finishes what it is handling before shutting down. And an unauthenticated connection is now closed after 30 seconds rather than being allowed to idle, which protects the service without affecting anyone who has logged in.

Free accounts in their first seven days can now send up to 200 emails an hour and 500 a day. Paid plans are unaffected, sandbox sending is unaffected, and the limit lifts by itself once the account is a week old. It is there so that one new account cannot burn through a month of volume overnight and drag down delivery for everyone else on the platform. If you are launching something and need more room straight away, upgrade your plan or contact support and we will raise it for you.

Our content checks also got better at spotting invoice fraud. We now catch messages that sign off as an executive of the company being written to, from a domain that has nothing to do with that company, when they also push the reader to release a payment or quote a conversation that never happened. Genuine invoicing mail is unaffected: naming your own company beside your own job title is normal business correspondence, and we checked this against tens of thousands of real messages before turning it on.

Free-plan mail sent in that first week no longer carries the “Sent with SendByte” footer.

The DNS records on the Domains page are easier to copy correctly. The mail-server priority (the “10” on the Return-Path record) now sits in its own Priority column with its own copy button, so it never gets pasted into the value box by mistake.

And if you send from a subdomain, the record names now include the subdomain (for example sb._domainkey.news), so you can paste them straight into your root domain’s DNS zone. Each field has its own copy button, matched to the Name, Priority, and Value boxes your DNS provider shows.

You can now look at your sent mail one sending domain at a time. On the Email log page, pick a domain from the new selector to see just that domain’s mail, its delivery and engagement stats, and its suppression list, with a Live and Sandbox switch to move between real and test sends. Leave it on “All domains” for the whole-project view you already know.

You can also give a teammate access to specific sending domains only. Restrict someone to one or more domains and their dashboard becomes exactly those domains: they see that mail and nothing else, while billing, API keys, and the team settings stay hidden. Set it from the Team page, and clear it any time to give full access back.

Nobody should discover they ran out of emails by watching their API calls fail. SendByte now emails you at every point on the usage journey, before anything surprises you:

• 80% of your included emails used: a heads up, with what happens next and time to upgrade or top up.
• Included emails used up: exactly what your account falls back on, whether that is your wallet balance, Always On, or a pause.
• Wallet running low: your balance and roughly how many emails it still covers.
• Always On billing started: the moment extra usage starts accruing, with your running total, the rate, and your safety cap.
• Sending paused or cap reached: told immediately, with every way to resume.

Each email includes exactly how to pay. If you are paying from outside Nigeria, use the card option at checkout: international cards are accepted and the conversion from Naira happens automatically.

These notifications fire once per billing period each, so your inbox is informed, never nagged.

SendByte started as transactional email built for Africa. It is becoming the communications API for Africa: email, marketing email, SMS, and WhatsApp through one API, one dashboard, and one bill.

Transactional email is live in production today, exactly as before, priced in Naira with no FX surprises. Marketing email, SMS, and WhatsApp are in build on the same surface, so your team learns one API and grows into the rest without changing vendors.

The site has been rebuilt around this. A new Platform page walks through all four channels and the shared foundation under them: in-region infrastructure, NDPR compliance, deliverability you can measure, and one integration that does not change per channel. The homepage, pricing, and navigation now reflect the platform, and every channel still in build carries a clear “Coming soon” label so you always know what you can use today.

If you want marketing email, SMS, or WhatsApp, you can now reserve your place. Request early access and we will bring you in as each channel opens, and share pricing with you first. Email is ready in the meantime, on a free tier with no card required.

Paying for a plan should feel instant, and now it does. The moment you land back from Paystack checkout, we verify your payment and apply it on the spot: your new plan, wallet top-up, or invoice settlement is live in about a second, instead of waiting on payment notifications that could take minutes. Slow bank transfers get an honest “settling” note and apply themselves automatically the moment they clear. As a further safety net, a background job sweeps for any confirmed payment that somehow slipped past both paths, so a payment can never be lost.

Every payment now also comes with an email receipt the moment it settles, confirming what you paid for and when your plan runs until.

And your Billing page has a new Payments section showing everything you have ever paid: plan purchases, renewals, overage invoices, and wallet top-ups, whatever way you paid. No more guessing what a debit was for.

The website now shows you the product instead of describing it. The homepage hero plays a full send the moment it loads: the API call, the 202 response with its email id, the delivered email, and the signed webhook landing back on your server. Press “Send again” to replay it.

Further down, the dashboard section opens a real send to its event timeline, with the SMTP response from the receiving server, opens, and clicks, exactly as you see it in the app. A new section covers open and click tracking, which is off by default and yours to enable per project.

The pricing page also gained a look inside billing: the live usage meter, the alerts we send at 80% and 100% of quota, and the payment history with a receipt for every charge.

The SendByte partner program is now fully self-serve. Open your dashboard, turn on partner mode, and you are earning the same minute, no application and no approval queue.

Three ways to earn. Refer: share your link and earn 25% of everything your referrals spend on plans for their first 12 months. Manage: run a client’s email sending with their one-click consent, and earn 20% of their plan spend for as long as you manage it. They keep full ownership of their account and can remove you at any time. Resell: own your clients’ workspaces outright, buy plans from us at 20% off list from a prepaid wallet, and charge your clients whatever you choose.

Your partner dashboard shows every client, every commission, and every payout in one place. Payouts go out monthly by bank transfer once your balance clears ₦10,000.

Read the full terms at sendbyte.africa/partner-terms or turn it on now in your dashboard.