Email Routing

Email Routing gives your domain real email addresses without renting a mailbox. You create info@example.ir, point it at an inbox you already read — your Gmail, your Outlook, your company mailbox — and nsin delivers everything that arrives for that address straight into it.

nsin publishes the DNS records, receives the mail on its own servers, and hands each message on. You’ll find it under Email in your domain’s sidebar.

What it is, and what it isn’t

Email Routing is a forwarder. It is not a mailbox.

Nothing is stored. A message exists on nsin only for the seconds it takes to pass it along. There is no inbox here to log into, no archive, and no way to re-deliver something afterwards.
Replies come from your own mailbox. When mail for info@example.ir lands in your Gmail and you hit reply, the answer goes out as your Gmail address. The person who wrote to info@ will see your personal address in the reply.
You cannot send as the address through nsin. nsin has no outgoing mail server for you to connect to. If you want replies to read as info@example.ir, set that up in the mailbox you read: Gmail’s Send mail as and Outlook’s equivalent both let you add another address, and both need an SMTP server that will send for your domain — from your host, your Google Workspace account, or a transactional provider. Email Routing handles the incoming half only.
Addresses live on the domain itself. info@example.ir works; addresses on a subdomain, like info@mail.example.ir, aren’t available yet.

Requirements

Your domain must use nsin’s DNS. Email Routing writes the MX, SPF and DKIM records into your zone, so the domain has to be in Managed DNS mode. See Domain Modes. Domains on external nameservers can’t use it yet.
Every plan includes it, including the free one. What changes with the plan is how many addresses a domain may have and how many messages it may forward per day. Your own numbers, and how much of them you’ve used, are shown on the Email page — see Plans.
If the Enable button isn’t showing at all, nsin’s mail servers are momentarily unavailable. Nothing is wrong with your domain; try again shortly.

Turning it on

Open your domain and go to Email.
Add a destination — the address you want mail delivered to. nsin sends a short confirmation email to it.
Click the link in that email within 24 hours. The link can be opened by anyone who has the mailbox, so a colleague can confirm their own address without an nsin account. If it doesn’t arrive, use Resend (available again after 60 seconds) and check the spam folder.
Create your first address, for example info, and pick the destination you just confirmed.
Press Add records and enable. nsin writes the records below, locks them, and starts accepting mail.

Mail usually starts flowing within minutes, though see DNS takes a moment below.

The records nsin adds

Five records go into your zone. You’ll see them in your DNS table like any others, marked as managed by Email Routing:

Type	Name	Value	Priority
MX	`@`	`mx1.nsin.cloud`	`10`
MX	`@`	`mx2.nsin.cloud`	`10`
MX	`@`	`mx3.nsin.cloud`	`10`
TXT	`@`	`v=spf1 include:_spf.mx.nsin.cloud ~all`	—
TXT	`nsin2026a._domainkey`	`v=DKIM1; k=rsa; p=…`	—

In plain words: the three MX records tell the world’s mail servers to deliver your domain’s mail to nsin. The SPF record says nsin is allowed to send mail on your behalf. The DKIM record publishes the public half of a signing key that is unique to your domain, so the mailboxes you forward to can verify the messages really came through you.

All three MX records share the same priority on purpose. Mail servers spread their deliveries across equal-priority hosts, which keeps all of nsin’s mail addresses in steady use — a mail server that only ever receives during an outage is one nobody trusts when the outage comes.

Your existing mail records

Email Routing replaces your current mail setup. If your domain already has MX records — Google Workspace, Microsoft 365, your hosting provider’s mail, an old server — mail cannot go to two places at once. nsin will not quietly overwrite them:

Before enabling, the panel lists the MX records it would remove and asks you to tick a box confirming that. Nothing happens until you do.
The removed records are kept as a snapshot. When you turn Email Routing off you can choose restore my previous MX records and they come back exactly as they were.

An existing SPF record is treated differently: it is merged, never duplicated. If your zone already says

v=spf1 include:_spf.google.com ~all

nsin rewrites that one record to

v=spf1 include:_spf.google.com include:_spf.mx.nsin.cloud ~all

This matters more than it looks. A domain is allowed exactly one SPF record — two of them is a permanent error that breaks all of your outgoing mail, not just the forwarded kind. If your zone already contains more than one SPF record, enabling stops and asks you to merge them into one first.

Locked records

While Email Routing is on, those five records are locked: you’ll see them in your DNS table, but the edit and delete buttons are off. It’s the same reasoning as the confirmation above — a stray edit to an MX record silently stops your mail, and you’d find out days later from someone who never got an answer.

Unlock them when you’re moving your mail somewhere else. Unlocking hands the five records back to you to edit or delete; routing keeps working for as long as the records still point at nsin, so you can cut over at your own pace. Lock them again if you change your mind. To leave properly, use Disable instead — it removes the records for you and can put your old ones back.

Custom addresses

Each address you create has one action:

Forward to — exactly one destination. One address, one mailbox; there is no way to fan a single address out to several people yet.
Drop — accept the message and throw it away, silently. Useful for an address a form or an old signature still uses, where you want the sender to see a normal “delivered” and you want to see nothing.

A few details worth knowing:

Case doesn’t matter. Info@example.ir and info@example.ir are the same address.
A dot is a real character. first.last@ and firstlast@ are two different addresses. (Gmail treats dots as nothing; your domain doesn’t.)
Letters, digits and the usual punctuation only, up to 64 characters before the @. Persian or Arabic characters in the part before the @ aren’t supported.
An address whose destination isn’t confirmed yet doesn’t run. It’s saved and shown as waiting for verification, and it starts working by itself the moment the link is clicked.
Mail to an address you never created is refused at the door with “user unknown”, and the sender’s own provider tells them so — exactly what would happen with a real mailbox that doesn’t exist. Turn on a catch-all if you’d rather not refuse anything.

Catch-all

The catch-all decides what happens to mail for every address you haven’t created — hello@, billing@, a typo of your own name. Switch it on and give it one action: forward everything to a destination, or drop everything.

Matching runs in this order, and the first match wins:

An exact address you created.
The subaddress rule below, if subaddressing is on.
The catch-all.

A forwarding catch-all is convenient and noisy — every spammer’s dictionary attack on your domain becomes mail in your inbox. A dropping catch-all is quiet, but a real customer who mistypes sales@ for sale@ never learns their message went nowhere.

Subaddressing (the `+` trick)

Subaddressing is a per-domain switch, off by default. With it on, info+newsletter@example.ir is delivered by your info@ address: nsin cuts the address at the first + and matches what’s in front of it.

It’s how you hand a different address to every service you sign up to and still receive everything in one place — and how you find out later which of them sold your address on.

If you create an address that literally contains a +, that exact rule wins over the stripped one. So info+shop@ with its own destination goes where you told it, while info+anything-else@ still lands on info@.

Destinations

A destination belongs to your account, not to one domain. Confirm me@gmail.com once and you can point addresses on every domain in your account at it — you’ll never receive that confirmation email twice.

The list on a domain’s page belongs to the domain’s owner. If you manage someone else’s domain as an Editor, you choose from their destinations rather than adding your own. See Sharing a Domain.
Resend is available again 60 seconds after the last send, and a confirmation link stops working after 24 hours. Ask for a new one whenever the old one goes stale.
Deleting a destination disables every address pointing at it, on every domain, straight away. The panel tells you how many that is before you confirm. The addresses themselves are kept — point them at another destination and they run again.
A destination can’t be an address on a domain that is itself routed through nsin. That would be a loop, and it’s refused when you add it.

The activity log

The Activity tab shows every message nsin handled for your domain: when it arrived, who it was from, which of your addresses it was for, the subject, and what happened to it. Above it, a summary of the same in counts, over anything from the last 30 minutes to the last 30 days.

Status	What it means
Forwarded	Delivered. The destination’s mail server accepted the message.
Dropped	Matched an address (or a catch-all) set to Drop. The sender saw a normal “delivered”; nothing was passed on.
Rejected	nsin refused the message and told the sender why. The row carries the reason.
Deferred	A temporary problem. nsin asked the sending server to try again later, and it will — usually for several days. Nothing is lost yet.
Bounce dropped	A delivery-failure notice came back for something nsin had forwarded. The diagnostic is recorded here and the notice is discarded rather than passed on to whoever wrote to you.

Open a row and you’ll also see the checks nsin ran on the sender — SPF, DKIM, DMARC and ARC — plus the sending server’s address and name, whether the connection was encrypted in each direction, the size of the message, and the exact reply nsin got from your destination’s server. That last one is the thing to read when a message you were expecting says rejected or deferred.

Why a message might not arrive

Forwarding is stricter than a normal mailbox, because everything nsin passes on goes out under nsin’s name. Some mail is turned away on purpose:

The sender proved nothing. Every message has to pass SPF or carry a valid DKIM signature. A message that does neither is rejected, and the sender’s provider bounces it back to them with the reason. In practice this is almost always a contact form or a script on cheap hosting that was never set up properly — and the fix is on the sending side.
The sender’s own domain says “reject”. If a domain publishes a DMARC policy of p=reject and the message fails it — a broken or missing signature, usually because something forwarded or modified it before it reached you — nsin honours that policy and refuses it. Doing anything else would be forwarding mail its own owner has disowned.
Your destination refused it. A full mailbox, an over-eager spam filter at Gmail or Outlook. nsin relays their answer, word for word, back to the original sender inside the same conversation — so the person who wrote to you sees the real reason rather than silence.
The daily forward limit was reached. nsin answers with a temporary error, so the sending server keeps the message and retries. Mail sent near your ceiling generally arrives on its own once the counter resets.
The message was too big — over 25 MiB, including attachments.

Every one of these appears in the activity log with its reason.

Limits


Maximum message size	25 MiB
Addresses per domain	Set by your plan — shown on the Email page
Forwards per day, per domain	Set by your plan — shown on the Email page
Destinations per account	200
Recipients per delivery	1
Activity log	30 days

One recipient at a time. nsin takes one of your addresses per delivery attempt. If somebody writes to info@example.ir and sales@example.ir in the same message, the first copy is delivered immediately and their mail server retries for the second a few minutes later. Both arrive; one is simply a little behind.

nsin never generates bounce messages. Addresses that don’t exist are refused while the sending server is still connected, and failures are reported back the same way. That means the sender always hears from their own provider — never a surprise message from a domain they’ve never heard of.

What nsin does to keep your mail deliverable

Forwarded mail is the hardest kind to deliver: Gmail sees a message written by someone else, arriving from a server that isn’t theirs, and has every reason to be suspicious. Four things keep it landing in the inbox:

The envelope is rewritten (SRS). The hidden return address on the message is swapped for one belonging to nsin, so the checks your destination runs point at a server that really did send it. The From: line you actually see is never touched — it still shows the person who wrote to you, and replying still reaches them.
A seal is added (ARC). Forwarding breaks the sender’s original SPF check by its nature. The ARC seal is nsin’s signed statement of what the message looked like when it arrived and which checks it passed, so your destination can reconstruct the truth instead of guessing.
Every message is signed twice (DKIM). Once as nsin, and once with the key published on your own domain. Your domain’s signature is why mail forwarded through nsin carries your own reputation rather than sharing one bucket with everyone else’s.
Connections are encrypted (TLS) in both directions whenever the server on the other end offers it.

The message itself is never altered. nsin adds its headers on top; the subject, the body, the attachments and the structure go on exactly as they were sent, byte for byte.

Troubleshooting

Nothing is arriving

Press “Check DNS” on the Email page. It looks your records up publicly, the way a sending mail server would, and tells you precisely which one is missing or has something unexpected next to it.
Give DNS a moment. Mail servers cache your old MX records, so a server that tried to reach your previous provider an hour ago may keep doing so for a few more hours. This is normal and resolves itself.
Check the address is on and its destination confirmed. An address waiting for verification doesn’t run.
Look at the Activity tab. A row means the message reached nsin, and its status says what happened next. No row at all means the sending server never got to nsin — which points back at DNS, or at the sender’s own provider.

Your test message vanished

Send the test from a different address than the destination. If you send from the same Gmail account that you’re forwarding to, Gmail recognises its own message coming back and hides the copy — the forward worked perfectly and you see nothing. It’s the single most common false alarm. Use another account, or a colleague’s.

It arrives, but in the spam folder

Mark it as not spam once, and ideally add a filter in your mailbox for mail sent to that address. New forwarding setups take a little while to establish themselves with the big providers.

Turning it off

Disable on the Email page removes the five records from your zone and stops accepting mail for the domain. You’ll be asked whether to restore your previous MX records — say yes if you’re going back to the mail provider you had before.

Your addresses and destinations are kept, so turning it back on later doesn’t mean starting over.