Connect
Email providers
Galactic Outreach sends through your account, not ours: the providers it speaks to, what each one needs, and the webhook that reports deliveries back.
By Joan Gumban · Last updated
Supported providers
Galactic sends through Resend, Amazon SES, Mailgun or SendGrid with your own key, or from your own Microsoft 365 or Google Workspace mailbox, so the mail leaves under your reputation. Choose with the next section in mind: every provider limits what you may send, and an account it closes stops your sending.
What does each provider cost?
What each one lets you send for free, how long that lasts, and what the first paid step costs. The provider bills you directly; none of it goes through Galactic.
Infrastructure / free tiers
What sending costs on each provider
Galactic connects to six. Every one sets limits and rules to protect its own reputation, and with it your domain's, so read them before you connect. The four sending services each let you start for free; a Microsoft 365 or Google Workspace mailbox is one you already pay for, and Galactic sends at most 50 emails a day from it.
| Free tier | Free plan Resend | Credits Amazon SES | Free plan Mailgun | Free trial SendGrid | Your mailbox Microsoft 365 | Your mailbox Google Workspace |
|---|---|---|---|---|---|---|
| Free sending | 3,000 emails / month | Up to $200 in AWS credits | 100 emails / day | 100 emails / day | Included in your plan | Included in your plan |
| Daily limit | 100 / day | 200 / day, verified recipients only | 100 / day | 100 / day | 10,000 recipients / day | 2,000 / day |
| How long | No end date | 6 months | No end date | 60 days | While you pay for it | While you pay for it |
| First paid step | $20/mo for 50,000 emails | $0.10–0.16 per 1,000 emails | $15/mo for 10,000 emails | $19.95/mo for 50,000 emails | Nothing extra | Nothing extra |
| Sending rules | Bans cold outreach and scraped lists | Bans unsolicited bulk email and bought lists | Consent required; no third-party lists | Opt-in required; no bought or scraped lists | Bans spam; not for bulk email | Bans unsolicited mass email |
Does my provider allow cold email?
Every provider sets rules on what may be sent, to protect its own sending reputation and, with it, your domain's. The four sending services restrict the kind of email a scraped list produces; the two mailboxes forbid spam and bulk mail and police it by volume and complaints. Read yours before you connect it: a provider can close an account without warning, and Galactic cannot send through a closed one.
What Galactic can do is keep an account under the numbers providers act on. With the webhook connected, the safety checks hold a send once bounces or spam complaints over the last 30 days reach the provider's own line: 0.08% complaints and 4% bounces for Resend, 0.1% and 5% for Amazon SES, 0.1% and 4% for Mailgun and SendGrid. That lowers the risk of a closure; it does not make cold email to a scraped list allowed where a provider's rules forbid it.
| Provider | What its policy says |
|---|---|
| Resend | Prohibits “unsolicited messages of any kind, including cold outreach, purchased lists, or scraped contact data”, and all mail must go to recipients who explicitly opted in. |
| Amazon SES | The AWS policy bans unsolicited mass email; SES prohibits purchased or rented lists, and leaving the sandbox asks you to confirm you only email people who asked for it. |
| Mailgun | Prohibits acquiring or sending to a third-party list; other marketing mail needs “clear, explicit and provable consent”. |
| SendGrid | Twilio's Email Policy requires “affirmative consent prior to sending any emails to a recipient”, and bans purchased lists and addresses taken from the internet without consent. |
| Microsoft 365 | Microsoft's terms forbid using the service to spam. Microsoft 365 is not for bulk commercial email, and each mailbox has sending limits; one that sends spam is blocked from sending. |
| Google Workspace | Google's policy forbids “unsolicited mass email, promotions, advertisements, or other solicitations”, and Google may suspend a user, or a whole organisation's account, that sends spam. |
How do I send from my own mailbox?
Choose Microsoft 365 or Google Workspace in Settings → Email provider. You connect through a small app you create once in your own admin, which takes about five minutes. Because the app lives inside your own organisation, Google does not have to verify it and Microsoft does not have to verify its publisher. Galactic then sends through Microsoft Graph or the Gmail API, as that mailbox, with permission to send and nothing else.
Work accounts only. Personal Gmail cannot be connected, because Google's policy for it forbids unsolicited commercial mail, and personal Outlook.com accounts cannot sign in to an app made for one organisation.
- Microsoft 365
- In the Microsoft Entra admin center, App registrations → New registration, for accounts in this organizational directory only, with a Web redirect URI (Settings shows the exact one to copy). Add the Microsoft Graph delegated permissions Mail.Send, User.Read and offline_access, create a client secret, then paste the Directory (tenant) ID, the Application (client) ID and the secret's Value into Settings and press Connect.
- Example: https://galacticoutreach.com/api/provider/oauth/microsoft/callback
- Google Workspace
- In Google Cloud, signed in with your Workspace account: create a project and enable the Gmail API. In Google Auth Platform set the audience to Internal and add the scopes gmail.send, openid and email. Create a Web application client with the redirect URI Settings shows, then paste its client ID and secret into Settings and press Connect.
- Example: https://galacticoutreach.com/api/provider/oauth/google/callback
- Send from a separate outreach domain and mailbox. A suspension for complaints can take a whole company's email with it.
- The same DNS applies: SPF and DKIM for the mailbox's domain, turned on in the Google Admin console or Microsoft's Defender portal, and a DMARC record. The safety checks read them for the connected address.
How many cold emails a day can I send from a mailbox?
Galactic sends at most 50 emails a day from a mailbox, whatever a run's limit says: a mailbox's reputation is a person's, and Google and Microsoft suspend accounts that send too much or draw complaints. Replies and bounces arrive in the mailbox itself, where Galactic cannot see them, so add a bounced address to the do-not-contact list yourself.
Why a mailbox, when its rules are strict too? Microsoft forbids spam and says Microsoft 365 is not for bulk commercial email; Google forbids unsolicited mass email and other solicitations. Neither names one business writing to another. What keeps a mailbox on the right side of those rules, as far as anything can, is how it is used: a few dozen emails a day, each to one business at the address it publishes, about something relevant to its work, from a named person who can be replied to, with an opt-out in every email. Galactic holds a mailbox to that shape with the 50-a-day cap, per-lead templates and the unsubscribe footer. It is not a promise: each provider decides for itself what it treats as spam, and a mailbox used for bulk or untargeted mail will be treated as a bulk sender.
Which DNS records do I need?
Three records on the sending domain. Your provider generates the exact values and shows them in its dashboard; what follows is what each one is for, so you can tell which has broken when mail starts landing in spam.
Verify it from a message that actually arrived rather than from a checker: open it in Gmail, choose Show original, and read the three lines at the top.
- SPF
- A TXT record naming the servers allowed to send as you. Without it, anything can. The include is your provider's: amazonses.com for Amazon SES and Resend, mailgun.org for Mailgun; SendGrid sets it up through its own CNAMEs.
- Example: send.mail.example.com TXT v=spf1 include:amazonses.com ~all
- DKIM
- A public key in DNS matching the signature on every message, so a receiving server can check it really came from your domain and arrived unaltered. The record's form is the provider's: a TXT for Resend, three CNAMEs for Amazon SES, CNAMEs or a TXT for Mailgun and SendGrid.
- Example: resend._domainkey.mail.example.com TXT p=MIGfMA0GCSqGSIb3…
- DMARC
- A policy telling receivers what to do with mail that fails DMARC: mail where neither SPF nor DKIM passes for a domain matching your From address. One aligned pass is enough. Since February 2024, Gmail and Yahoo require a DMARC record from bulk senders (for Gmail, about 5,000 or more messages a day to Gmail accounts); p=none is enough to start.
- Example: v=DMARC1; p=none; rua=mailto:dmarc@example.com
- Send from a subdomain, so cold outreach cannot damage your main domain's reputation.
- Add the provider's custom return-path records, so SPF aligns with your From domain rather than theirs.
- Give the sending subdomain an MX record. A From domain that cannot receive mail is a negative signal, and replies to it bounce.
- Amazon SES starts every account in a sandbox: 200 emails a day, to verified addresses only. Request production access from the SES console, once for each Region you send from; AWS replies within a day.
Delivery webhooks
Each provider posts events to its own endpoint, with your campaign's id in the path. Settings → Email provider shows the exact URL to paste, along with the signing secret field that verifies the events really came from your provider.
POST /api/webhook/resend/<campaign-id>
POST /api/webhook/ses/<campaign-id>
POST /api/webhook/mailgun/<campaign-id>
POST /api/webhook/sendgrid/<campaign-id>Which events to send
Subscribe to these three at a minimum. Without them you find out about a bounce or a complaint when your domain stops reaching inboxes, which is far too late to act on.
- delivered
- The provider handed the message to the receiving server. This is what fills the Delivered count on Emails sent; the send log itself records only that the provider accepted the message.
- Example: { "type": "email.delivered", "email_id": "4ef9…" }
- bounced
- The address rejected it. Galactic adds the address to the do-not-contact list so it is never tried again.
- Example: { "type": "email.bounced", "bounce_type": "Permanent" }
- complained
- Someone pressed Report spam. The same suppression applies, and a rising rate here is the signal to stop sending.
- Example: { "type": "email.complained" }
How do I know an event really came from my provider?
Every request is verified before anything is written. Resend's carry a signature made with your signing secret, Mailgun's an HMAC made with its webhook signing key, and SendGrid's an ECDSA signature checked against the public verification key you paste. Amazon SES's arrive through SNS at an address carrying a secret of its own in the query string, and that secret is checked before anything else runs.
A request that fails verification is refused, and nothing from it is recorded.
What if an event arrives twice?
Providers retry, so the same event can arrive more than once. Each is recorded under its own id, and a repeat is acknowledged and dropped rather than counted twice.
A temporary bounce, a full mailbox for example, is recorded as a delay rather than a bounce, so it does not put anyone on the do-not-contact list.