Mailboxes page: add a sending mailbox with just its address and password

[ralyodio]

Anthony asked for a way to add a mailbox to outreachgraph.com, with UX like Swokei's /mailboxes, for fully automated cold email.

What ships

• /mailboxes page, linked from Settings. It has a stats strip and one card per mailbox, with an empty state that prompts for the first connection.

• Add mailbox dialog, in the Swokei flow:

  1. Google / Microsoft / Any other provider (IMAP and SMTP) tiles.
  2. Email + password. The servers are detected (see below), the daily limit and warm-up are set here, and server settings are folded away.
  3. Live test.
  4. Domain DNS check.

• Detection (POST /api/v1/mailboxes/detect) tries, in order:

  1. known consumer domains
  2. the MX provider (Google, Microsoft, Forward Email, Fastmail, Zoho)
  3. Mozilla ISPDB autoconfig
  4. a labelled smtp./imap. guess

  Live checks: anthony@profullstack.com → Forward Email, and anthropic.com and octavehot.org → Google Workspace.

• Connect verifies IMAP too. Before this, only SMTP was checked, which is how a mailbox sent about 280 emails and never read a reply.

• Per-mailbox health:

  • a 0–100 score: warm-up progress minus a stopped account, bounces, and unread replies
  • bounce risk (low/medium/high, 30 days)
  • sent today / cap, and the warm-up day
  • "inbox checked N min ago", or the last IMAP error (migration 0047, written by the reply poller)

• DNS check (GET /api/v1/mailboxes/:id/dns): SPF (including whether it names the provider), DKIM (known selectors), DMARC and MX, each with the record to add. Live result for profullstack.com: SPF, DMARC and MX pass, and DKIM warns because Forward Email's fe-… selector can't be looked up from outside.

• CLI: og mailboxes, og mailboxes detect|dns|add <email>. add reads the password from a hidden prompt or OG_MAILBOX_PASSWORD.

• MCP: list_mailboxes, check_mailbox_dns.

Sending rotation, sticky per-lead mailboxes, warm-up and bounce auto-pause already exist (sender pool, #91). This PR is the page, onboarding and health on top of them.

Not included

• Google/Microsoft OAuth connect. Google and Microsoft tiles use app passwords over IMAP/SMTP, as before.
• A managed pre-warmed mailbox pool like Explee's.

Checks

• Tests: domain, providers, pipeline, API (mailboxes.test.ts, senders.test.ts), CLI and MCP all pass locally.
• bun run typecheck and apps/web tsc --noEmit are clean.
• /mailboxes rendered against a local API with seeded mailboxes.

🤖 Generated with Claude Code