Email, SMS & WhatsApp

Proofloop sends through your own provider account. Nothing routes through our servers, there is nothing we can switch off, and you pay your provider directly at their rates.

Why bring your own provider

A review-request tool that sends through the vendor’s shared infrastructure inherits the vendor’s sender reputation — including whatever the vendor’s other customers did last week. It also gives the vendor a switch. Proofloop has neither: your provider, your domain, your reputation.

Choosing an email provider

Provider	Good for	What you need
SMTP	Anything, including your host’s own mail server	Host, port, username, password, encryption
Mailgun	Volume, EU data residency	API key, sending domain, region
Postmark	Best-in-class deliverability for transactional mail	Server API token, verified sender signature
Resend	Quick setup, modern dashboard	API key, verified domain
Amazon SES	Lowest cost at scale	Access key, secret, region — and production access, see below

Amazon SES starts in a sandbox

A new SES account can only send to addresses you have verified yourself. You have to request production access from the AWS console before it will send to customers. It is usually granted within a day, but do not discover it on the morning of your first campaign.

Getting past spam filters

This section matters more than which provider you pick. An email that lands in spam is worse than one you never sent: it trains the recipient’s mail server to distrust your domain.

1. Send from your own domain

Not from gmail.com, yahoo.com or any other free provider. Since February 2024 both Gmail and Yahoo reject bulk mail that claims to be from their own domains, and “bulk” is defined low enough that a modest campaign qualifies.

2. Publish SPF, DKIM and DMARC

Your provider gives you the exact DNS records; add them wherever your domain’s DNS is hosted. Proofloop’s deliverability wizard (Settings → Sending → Check domain) then looks each one up and tells you which are missing, so you are not reading raw DNS output.

Record	What it does	Typical value
SPF	Lists the servers allowed to send as your domain	`v=spf1 include:provider.example ~all`
DKIM	Cryptographically signs each message	A `TXT` record at a selector your provider names
DMARC	Tells receivers what to do when the first two fail, and where to send reports	`v=DMARC1; p=none; rua=mailto:you@yourdomain.com`

Start DMARC at p=none, read the reports for a fortnight, then move to p=quarantine. Going straight to p=reject is how people discover their invoicing system was also sending as that domain.

3. Send a real test before you send a campaign

Proofloop will not run a campaign until a test send has genuinely arrived. This is deliberate, and it is not a formality you can turn off: a first campaign from an unverified domain burns the list and the domain reputation in one go.

SMS and WhatsApp with Twilio

Create a Twilio account and buy a number capable of SMS in the countries you send to.
From the Twilio console dashboard copy your Account SID and Auth Token.
In Proofloop open Settings → Sending → Twilio, paste both, and choose the sending number. The token is encrypted before it is stored and is never shown again in full.
Send a test message to your own phone. As with email, campaigns stay locked until one arrives.

WhatsApp needs approved templates

WhatsApp does not allow free-form messages to someone who has not messaged you in the last 24 hours, which is every review request. You must therefore use a template that Meta has approved, and approval takes anywhere from minutes to a couple of days.

In the Twilio console, open Messaging → Content Template Builder.
Create a template in the utility category. Review requests are transactional, not marketing, and mis-categorising them is the most common rejection reason.
Put your variables in as {{1}}, {{2}} and so on.
Once approved, paste the template SID into Proofloop and map each variable to a Proofloop field.

Country rules worth knowing

United States: A2P 10DLC registration is required before you can send to US numbers at all. Unregistered traffic is filtered silently.
India: DLT registration of both sender and template is mandatory.
Indonesia, and much of Southeast Asia: alphanumeric sender IDs need pre-registration through Twilio.
Everywhere: include a way to opt out, and honour it. Proofloop maintains a suppression list automatically and never sends to an address or number on it.

Quiet hours, throttling and cost

Proofloop will not send between 21:00 and 08:00 in the recipient’s local time, worked out from their country. A review request at 3am does not get answered; it gets you reported. The window is configurable per organisation.

Sending is throttled per hour and per day, both configurable. This protects your sender reputation from a mis-clicked campaign more than it protects anything else.

About the cost estimator

The per-message costs Proofloop shows are estimates for planning, not a bill. Real SMS pricing varies by country, by carrier, and by your own Twilio volume tier. Always check your provider invoice for the authoritative number.

Delivery status

Each provider can call Proofloop back when a message is delivered, bounces, or is marked as spam. Add these URLs in your provider dashboard and the send log stops guessing.

Mailgun    https://yourdomain.com/webhooks/mailgun
Postmark   https://yourdomain.com/webhooks/postmark
Resend     https://yourdomain.com/webhooks/resend
Amazon SES https://yourdomain.com/webhooks/ses     (via an SNS topic)
Twilio     https://yourdomain.com/webhooks/twilio

Every one of these verifies the provider’s signature before it changes anything. A hard bounce or a spam complaint adds the recipient to the suppression list permanently.