Changelog

When we review an account and mark it trusted, that is meant to be the end of our second-guessing your content. It was not quite. Three checks still applied to trusted accounts, and one of them, our check for a sender posing as the recipient’s own organisation, catches something that legitimate software does all day: naming the customer in the subject line. An invoice reading Invoice INV-2041 from Acme for Northline Logistics, sent to someone at Northline, looked the same to the filter as a message pretending to be Northline. Sends like that were rejected with content_flagged even though the account was trusted.

Trusted accounts are no longer content-filtered at all. Every signal is still scored and recorded on the email so you can see it in your log, and it is still visible to us, but nothing about the wording of your message can stop it from being sent.

This does not weaken anything for other accounts. The filter is unchanged for everyone who has not been individually reviewed, and the protections that matter most, sending limits, reputation monitoring, and suppression enforcement, apply to every account including trusted ones. Those watch how an account behaves rather than how it writes, which is the right way to catch a problem without punishing normal transactional mail.

If your sends are being rejected for content that you know is legitimate, contact support and ask us to review the account.

You can now embed an image inside the body of an email instead of sending it as a download. Give the attachment a content_id and reference it from your HTML:

"html": "<img src=\"cid:logo\" width=\"120\" alt=\"Acme\">",
"attachments": [
  { "filename": "logo.png", "content": "iVBORw0KGgo...", "content_type": "image/png", "content_id": "logo" }
]

We compose the message as multipart/related with a Content-ID header on the inline part, which is how Gmail, Outlook, Apple Mail and Thunderbird resolve a cid: reference. Attachments without a content_id stay ordinary downloads, so one message can carry an embedded logo and an attached invoice.

If your HTML points at a cid: that no attachment provides, the send is now rejected and tells you which reference is unmatched, rather than delivering an email with a broken image.

Sending through the SMTP relay needs no changes at all, and it works better than before: inline images composed by your mail client or library previously lost their Content-ID on the way through, so they arrived as a plain attachment next to a broken image. They now come through intact.

Inline images count against the ten-file and message-size limits, so a hosted https image is still the better choice for anything large or anything you may want to swap out after sending.

Our abuse filter checks whether a link’s visible text matches where the link actually goes, because a mismatch is a classic phishing tell. It was too strict. If your email showed your own domain as the link text but pointed at your app on a different host, for example text reading acme.io/r/abc linking to acme-app.fly.dev, the message was rejected with content_flagged. That is normal product mail, and it was blocking real sends.

A domain shown in link text now only counts against you when it belongs to neither the link’s destination nor your own sending domain. Displaying your own domain is fine. Genuine phishing, where a message displays someone else’s domain and links somewhere unrelated, is still blocked exactly as before.

We also stopped mistaking three things for domains in link text: file names such as invoice-July.pdf, email addresses, and version numbers such as v1.2.10. Any of those could previously trip the check on its own.

If a message of yours was ever rejected for this, it will now go through. Nothing about your setup needs to change.

If your mailer holds one authenticated SMTP connection open and sends many messages through it, as Symfony Mailer, Nodemailer and most connection pools do, that now works properly. Our relay was closing idle connections after 30 seconds, so the next message on a reused connection failed with a 421 timeout. The idle limit is now 5 minutes, which is what the SMTP standard asks for, and NOOP keepalives work if you want to hold a connection open indefinitely.

The limits that govern an SMTP session are now written down in the SMTP guide: idle timeout, time allowed to authenticate, messages per connection, recipients per message, and message size. If you pool connections, that page tells you exactly what to configure.

We also fixed a fault that stopped pay-as-you-go sends over SMTP. If your account used up its included monthly sends, the charge against your wallet balance was failing, so those sends were rejected even with a funded wallet and pay-as-you-go switched on. Sends through the API were never affected. This is fixed, and sending now draws on your wallet as it should.

Two smaller improvements in the same release. Deploys no longer interrupt messages that are mid-transmission: the relay finishes what it is handling before shutting down. And an unauthenticated connection is now closed after 30 seconds rather than being allowed to idle, which protects the service without affecting anyone who has logged in.

Free accounts in their first seven days can now send up to 200 emails an hour and 500 a day. Paid plans are unaffected, sandbox sending is unaffected, and the limit lifts by itself once the account is a week old. It is there so that one new account cannot burn through a month of volume overnight and drag down delivery for everyone else on the platform. If you are launching something and need more room straight away, upgrade your plan or contact support and we will raise it for you.

Our content checks also got better at spotting invoice fraud. We now catch messages that sign off as an executive of the company being written to, from a domain that has nothing to do with that company, when they also push the reader to release a payment or quote a conversation that never happened. Genuine invoicing mail is unaffected: naming your own company beside your own job title is normal business correspondence, and we checked this against tens of thousands of real messages before turning it on.

Free-plan mail sent in that first week no longer carries the “Sent with SendByte” footer.

The DNS records on the Domains page are easier to copy correctly. The mail-server priority (the “10” on the Return-Path record) now sits in its own Priority column with its own copy button, so it never gets pasted into the value box by mistake.

And if you send from a subdomain, the record names now include the subdomain (for example sb._domainkey.news), so you can paste them straight into your root domain’s DNS zone. Each field has its own copy button, matched to the Name, Priority, and Value boxes your DNS provider shows.

You can now look at your sent mail one sending domain at a time. On the Email log page, pick a domain from the new selector to see just that domain’s mail, its delivery and engagement stats, and its suppression list, with a Live and Sandbox switch to move between real and test sends. Leave it on “All domains” for the whole-project view you already know.

You can also give a teammate access to specific sending domains only. Restrict someone to one or more domains and their dashboard becomes exactly those domains: they see that mail and nothing else, while billing, API keys, and the team settings stay hidden. Set it from the Team page, and clear it any time to give full access back.

Nobody should discover they ran out of emails by watching their API calls fail. SendByte now emails you at every point on the usage journey, before anything surprises you:

• 80% of your included emails used: a heads up, with what happens next and time to upgrade or top up.
• Included emails used up: exactly what your account falls back on, whether that is your wallet balance, Always On, or a pause.
• Wallet running low: your balance and roughly how many emails it still covers.
• Always On billing started: the moment extra usage starts accruing, with your running total, the rate, and your safety cap.
• Sending paused or cap reached: told immediately, with every way to resume.

Each email includes exactly how to pay. If you are paying from outside Nigeria, use the card option at checkout: international cards are accepted and the conversion from Naira happens automatically.

These notifications fire once per billing period each, so your inbox is informed, never nagged.

SendByte started as transactional email built for Africa. It is becoming the communications API for Africa: email, marketing email, SMS, and WhatsApp through one API, one dashboard, and one bill.

Transactional email is live in production today, exactly as before, priced in Naira with no FX surprises. Marketing email, SMS, and WhatsApp are in build on the same surface, so your team learns one API and grows into the rest without changing vendors.

The site has been rebuilt around this. A new Platform page walks through all four channels and the shared foundation under them: in-region infrastructure, NDPR compliance, deliverability you can measure, and one integration that does not change per channel. The homepage, pricing, and navigation now reflect the platform, and every channel still in build carries a clear “Coming soon” label so you always know what you can use today.

If you want marketing email, SMS, or WhatsApp, you can now reserve your place. Request early access and we will bring you in as each channel opens, and share pricing with you first. Email is ready in the meantime, on a free tier with no card required.

Paying for a plan should feel instant, and now it does. The moment you land back from Paystack checkout, we verify your payment and apply it on the spot: your new plan, wallet top-up, or invoice settlement is live in about a second, instead of waiting on payment notifications that could take minutes. Slow bank transfers get an honest “settling” note and apply themselves automatically the moment they clear. As a further safety net, a background job sweeps for any confirmed payment that somehow slipped past both paths, so a payment can never be lost.

Every payment now also comes with an email receipt the moment it settles, confirming what you paid for and when your plan runs until.

And your Billing page has a new Payments section showing everything you have ever paid: plan purchases, renewals, overage invoices, and wallet top-ups, whatever way you paid. No more guessing what a debit was for.

The SendByte partner program is now fully self-serve. Open your dashboard, turn on partner mode, and you are earning the same minute, no application and no approval queue.

Three ways to earn. Refer: share your link and earn 25% of everything your referrals spend on plans for their first 12 months. Manage: run a client’s email sending with their one-click consent, and earn 20% of their plan spend for as long as you manage it. They keep full ownership of their account and can remove you at any time. Resell: own your clients’ workspaces outright, buy plans from us at 20% off list from a prepaid wallet, and charge your clients whatever you choose.

Your partner dashboard shows every client, every commission, and every payout in one place. Payouts go out monthly by bank transfer once your balance clears ₦10,000.

Read the full terms at sendbyte.africa/partner-terms or turn it on now in your dashboard.

The website now shows you the product instead of describing it. The homepage hero plays a full send the moment it loads: the API call, the 202 response with its email id, the delivered email, and the signed webhook landing back on your server. Press “Send again” to replay it.

Further down, the dashboard section opens a real send to its event timeline, with the SMTP response from the receiving server, opens, and clicks, exactly as you see it in the app. A new section covers open and click tracking, which is off by default and yours to enable per project.

The pricing page also gained a look inside billing: the live usage meter, the alerts we send at 80% and 100% of quota, and the payment history with a receipt for every charge.

Running out of included emails mid-campaign used to mean a hard stop until the next month. With Always On, your emails keep sending past your plan’s included volume, and the extra usage simply goes onto a monthly invoice at your plan’s overage rate (the pay-as-you-go rate on the Free plan).

Paid plans have Always On active out of the box. On the Free plan it is an opt-in toggle on the Billing page, with a safety cap on how much extra usage can accrue in a period so there are never surprise bills. You will get an email the moment overage starts, a live running total in your dashboard, and the invoice when the period ends.

Settling an invoice is automatic where possible: we collect from your wallet balance or saved card first, and otherwise send you a secure Paystack payment link, with a Pay now button in the dashboard too. Keep one invoice at most outstanding and nothing ever interrupts your sending.

Freelancers and agencies can now earn recurring income with SendByte, in three ways. Refer clients with a link and earn a share of what they spend. Manage email for clients from your own workspace while they keep their own account. Or resell SendByte at wholesale and set your own price.

One dashboard, one partner per account, and monthly payouts in Naira. See how the models compare and choose the one that fits on the partners page, or email partners@sendbyte.africa.

You can now see who opened your emails and which links they clicked. Turn on tracking from the Emails page in the dashboard (opens and clicks are separate switches), and every new send records its engagement: counts in the email log, a per-event timeline on each email, and email.opened / email.clicked webhook events for your own systems. Any single send can override the project setting with the new tracking field on the send API.

Tracking links live on our tracking host by default, but you can put them on your own domain instead. On the Domains page, enable branded tracking links, add the one CNAME record we show you, and we handle the certificate automatically. Until the record is live your emails simply keep using the shared host, so nothing ever breaks.

Tracking is off by default and never applies retroactively: only emails sent after you switch it on are measured.

When an address hard bounces or marks a message as spam, we suppress it so you keep a healthy sending reputation. Sometimes that address is fixed and the person genuinely wants your email again. You can now request removal directly from the dashboard.

Open the new Suppressions page, find the address, and send a confirmation email. The recipient clicks a link to confirm they want your mail, and only then is the suppression removed automatically. Because the recipient has to opt back in themselves, you stay compliant and your reputation stays protected. The whole flow is also available through the API and the Node SDK, with webhook events for each step so you can track it in your own systems.

Getting DNS records right is the hardest step of setting up a sending domain, and when it goes wrong it usually fails silently: the records look fine to you, but verification never completes.

If your domain has been sitting unverified for a couple of days, we now send you a short note walking through the most common causes, things like propagation delays, a host field that doubles up your domain, or proxied records on Cloudflare. Still stuck a week later? We offer to check your DNS for you. Just reply to the email, tell us where your DNS is hosted, and a person will look at what is publicly visible and tell you exactly what to change. Once your domain verifies, the check-ins stop on their own.

Our private beta has ended and SendByte is open to everyone. You can create an account and send your first email in minutes, no invite needed.

Every new account starts on the Free plan with 3,000 emails a month and no card required, plus a one-time welcome credit so you have room to grow past the free quota from day one. When you are ready for more, Startup and Scale are a click away.

Thank you to every beta developer who sent with us early and shaped the product. This is just the start.

You can now reference a template in your POST /v1/emails call by either its ID or its name, so you can use the friendly name you gave it instead of looking up a UUID. The template editor now shows a copyable Template ID right above the editor, and the API docs use the correct ID format. Sends that reference a template that does not exist now return a clear, actionable error.

We refreshed the icons throughout the dashboard to a single, modern, consistent set. Nothing moved and nothing changed in how things work. The icons are just clearer and easier to scan, and they stay crisp in both light and dark mode.