Frequently asked questions
Is the key secret?
No. The key is public and belongs in your source code. It only allows submitting to your form. Use allowed domains to limit which websites can do so.
Do I need a data processing agreement?
Yes. Mailiy processes personal data on your behalf, so you need a DPA under GDPR Art. 28. You conclude it with a checkbox when you sign up; the text is under “DPA”.
Where are the servers?
On a Linux server in a data centre in the EU. Mailiy uses no external CDNs, fonts or analytics.
What happens when the limit is reached?
Further submissions that month are rejected with a clear error message. The quota resets at the start of each month.
Does it work with React, Astro or WordPress?
Yes. Mailiy is a plain HTTP endpoint. Anything that can submit a form or call fetch() works.
Can people attach files?
Yes, up to five files with 10 MB in total per submission. PDF, images, text, office documents and CSV are allowed. Mailiy checks that the content matches the file extension and scans every file for viruses. The form needs enctype="multipart/form-data".
How does Mailiy keep spam out?
A hidden honeypot field, a limit of five submissions per minute per visitor, allowed domains and a content filter with two levels. You can block IP addresses yourself. Whatever the content filter catches goes to the spam tab, so you don't lose a real message.
Do I need a captcha?
Usually not. Captcha is off by default because the other filters are enough for most forms. If a lot of spam still gets through, turn on ALTCHA, hCaptcha, Cloudflare Turnstile or reCAPTCHA per website.
Who receives the emails?
The recipients you enter per website or form. Each new address has to be confirmed once by link before Mailiy delivers to it. Without recipients, the message goes to your account's email address. The ccemail and bccemail fields copy in further confirmed addresses.
How do I redirect to my own page after submitting?
Enter a redirect URL in the form settings or send a hidden redirect field. Without either, Mailiy shows a plain thank-you page.
Does the sender get a confirmation?
If you set up an autoresponder, yes. It goes to the address from the email or replyto field. You write the text yourself in the dashboard.
How long does Mailiy keep submissions?
As long as you set per form: 7, 30, 90, 180 or 365 days. With “Don't store”, the message is only delivered by email and never appears in the dashboard. After that, Mailiy deletes the entries and their files automatically.
Can I send submissions to other tools?
Yes. New submissions can also go to Slack, Discord or Telegram. A webhook sends them as JSON to your CRM, to Zapier, Make or your own code. In the dashboard you export everything to CSV.
Why is no email arriving?
The usual causes: the access key was copied wrong, the domain is missing from the allowed list, a new recipient hasn't confirmed their address yet, or the message is in your mailbox's spam folder. The dashboard shows whether the submission arrived and whether it was marked as spam.
Can I manage forms through an API?
Yes. With an API key you create and change forms and read submissions. There is a TypeScript SDK and an MCP server that AI assistants can use to set up forms.
Need a custom solution?
Your own sender domain, self-hosting or high volumes: tell us what you need and we'll work out what's possible.