# Deliverability & limits

An Extrovert inbox is a real account an agent can use for sign-ups, replies, notifications, and reviewed outbound mail. Extrovert provides authenticated sending and a rolling limit so one inbox cannot consume unbounded shared capacity.

## Authenticated sending

Every inbox is registered as an authenticated sender when it is created. Extrovert publishes or verifies the required SPF, DKIM, and DMARC records for the sending domain. NS-delegated domains let Extrovert serve those records and MX directly.

Authentication makes the sender legitimate; it does not guarantee inbox placement. Content, recipient expectations, complaints, bounces, and domain history still affect delivery.

## The rolling send limit

The volume control is a per-inbox rolling 24-hour recipient limit.

| Setting | Current behavior |
|---|---|
| Default | 75 recipients per rolling 24 hours |
| Configuration | `daily_send_limit` on the inbox |
| Allowed range | 1–10,000 |
| Required permission to change | `mailbox:quota` |
| Over the limit | `429` with `Retry-After` |

The limit counts recipients, not API calls. A single message addressed to multiple people consumes capacity for each recipient.
**Creation quota and send limit are different:** An account's ability to create another inbox is separate from an existing inbox's rolling recipient limit. Inspect the actual API response and effective inbox settings instead of inferring one from the other.

## Review and suppression controls

Agent-plane sends follow the effective review policy. A queued response means nothing was delivered yet. Suppression and contact-list checks run before release, and subscribed bulk mail can receive unsubscribe headers when that feature is configured.

Direct SMTP is different: it bypasses Extrovert review, suppression and contact-list enforcement,
unsubscribe injection, and platform accounting. It is disabled per inbox by default and can be
enabled only by a human administrator for a paid account. Exported credentials do not grant SMTP
submission on their own. API, SDK, and MCP sends continue through the Review Loop regardless of this
setting.

## Inspect current status

Use `get_deliverability_status` for the current organization rollup and
`list_deliverability_findings` for bounded, actionable findings. The console groups these under
**Deliverability** with health and suppression views. Treat provider-specific diagnostics as internal;
public errors and instructions describe the condition and recovery action without exposing the
underlying sending vendor.

## Reputation isolation

Domains and delegated subdomains have their own authentication configuration. Use separate domains when workloads require independent operational or reputation boundaries; do not assume the platform dynamically scores or reroutes senders.

## Next

- [Domains & onboarding](https://docs.extrovert.dev/concepts/domains-and-onboarding/)
- [Rate limits & quotas](https://docs.extrovert.dev/operating/limits/)
- [Unsubscribes & suppression](https://docs.extrovert.dev/concepts/unsubscribes-and-suppression/)
- [The Review Loop contract](https://docs.extrovert.dev/review-loop/agent-contract/)