AgentSkillsCN

sendgrid-inbound

在接收来自SendGrid的入站邮件时使用(入站解析Webhook)。涵盖DNS/MX设置、Webhook处理、有效载荷解析、附件处理以及安全性保障。

SKILL.md
--- frontmatter
name: sendgrid-inbound
description: Use when receiving inbound emails with SendGrid (Inbound Parse Webhook). Covers DNS/MX setup, webhook handling, payload parsing, attachments, and security.

Receive Emails with SendGrid (Inbound Parse)

Overview

SendGrid’s Inbound Parse Webhook receives emails for a specific hostname/subdomain, parses the message, and POSTs it to your webhook as multipart/form-data.

Key differences vs Resend:

  • SendGrid posts the full parsed email (text/html/headers/attachments) directly to your webhook.
  • There is no official signature verification for Inbound Parse (unlike SendGrid Event Webhook). You must secure the endpoint yourself.

Quick Start

  1. Create MX record pointing to mx.sendgrid.net for a dedicated hostname (recommended: subdomain).
  2. Configure Inbound Parse in SendGrid Console with a receiving domain + destination URL.
  3. Handle the webhook: parse multipart/form-data, read text, html, headers, and attachments.
  4. Secure the endpoint (basic auth, allowlists, size limits).

DNS / MX Setup

Create an MX record for a dedicated hostname:

SettingValue
TypeMX
Hostparse (or another subdomain)
Priority10
Valuemx.sendgrid.net

Recommendation: Use a subdomain to avoid disrupting existing email providers (e.g., parse.example.com).

Inbound Parse Configuration

In SendGrid Console:

  • Settings → Inbound Parse
  • Add Receiving Domain and Destination URL
  • Example receiving address: anything@parse.example.com

Webhook Payload (Multipart/Form-Data)

SendGrid posts data like:

  • from, to, cc, subject
  • text, html
  • headers (raw email headers)
  • envelope (JSON with SMTP envelope data)
  • attachments (count)
  • attachmentX (file content; filename in part)

Example fields (varies by config):

code
from: "Alice <alice@example.com>"
to: "support@parse.example.com"
subject: "Help"
text: "Plain text body"
html: "<p>HTML body</p>"
headers: "...raw headers..."
envelope: {"to":["support@parse.example.com"],"from":"alice@example.com"}
attachments: 2
attachment1: <file>
attachment2: <file>

Security Best Practices

Because Inbound Parse has no signature verification, treat inbound data as untrusted:

  • Require basic auth on the webhook URL.
  • Allowlist sender domains if appropriate.
  • Limit request size (e.g., 10–25 MB) to avoid abuse.
  • Validate content-type (multipart/form-data).
  • Do not execute or render HTML without sanitization.
  • Protect against prompt injection if forwarding to AI systems.

Examples

See: