Receiving & Forwarding

Replying "from" your domain matters little if replies to it bounce. Receiving usually means either paying for another mailbox seat or wrestling a forwarding service. Since your domain is already verified for sending, GoShipFast closes the loop: one MX record, and mail to your domain flows wherever you want it.

Reply forwarding

Email → Setup → Forwarding. Enter your everyday mailbox (the one you actually read), add the MX record shown, and Start forwarding. From then on:

Default forwarding (catch-all): mail to any address at your domain — hello@, support@, press@, anything — lands in your inbox. Addresses exist the moment someone writes to them; no mailbox administration, ever.
Specific addresses: add explicit rules when different addresses should go different places (support@ to the shared inbox, founders@ to you). Specific rules win over the catch-all.

Forwarded mail arrives intact — attachments, HTML, inline images — with headers adjusted only as required for the re-delivery to be accepted. You can pause or turn forwarding off at any time.

Every inbound message appears in Tracking → Inbound with its outcome: received, forwarded, forward failed, or skipped — so "did that mail ever arrive?" has a checkable answer.

The inbound webhook

Forwarding serves the human; the webhook serves your software. Configure an endpoint URL in Setup → API → Inbound webhook and every received message is also POSTed to you as an email.received event: from, to, subject, and the message body (text and HTML, truncated at a sane size).

Uses that come up constantly: piping support@ into a ticketing tool, letting users email content into your app, kicking off automations when a specific address is written to.

Verifying signatures

Each delivery is signed so you can reject forgeries. Two headers accompany the POST:

X-GSF-Timestamp — the delivery time.
X-GSF-Signature — an HMAC-SHA256, computed with your webhook's signing secret over the string timestamp + "." + raw request body.

Recompute the HMAC on your side, compare (constant-time), and reject stale timestamps to block replays. The API docs page in the product includes a copy-paste verification snippet; the signing secret is shown alongside the endpoint configuration and can be rotated.

Notes and limits

Receiving requires a verified sending domain — inbound is a mode on the domain, not a separate product.
The MX record points your domain's mail at GoShipFast's receiving infrastructure. If the domain already runs mailboxes elsewhere (Google Workspace MX), think before switching: MX is singular, and pointing it here routes all the domain's mail through forwarding. The common safe pattern is receiving on a subdomain, or on a domain that has no mailboxes yet.
Forwarding and webhook are independent toggles; run either or both.