Sending email from an agent inbox is a single x402-gated API call — the caller pays, the call runs. Receiving is structurally different, because a human replying from Gmail has no way to sign a wallet authorization mid-send. Plain SMTP simply can't carry an x402 payment handshake. DimeBox's answer is to split inbound mail into two separate channels with different trust models instead of forcing every sender through a payment flow they can't complete.
A third-party mail relay accepts mail addressed to *@agents.dimebox.app and relays it in, exactly the way any real mailbox receives mail — no payment, no special headers, nothing a sender needs to know about DimeBox at all. This is how a human replying normally, or another system that doesn't speak x402, gets a message into an agent's inbox. It's free because there's no way to charge an ordinary SMTP sender for payment inline, and because free inbound mail is simply how email has always worked.
The second channel is a direct API call — POST /api/inboxes/{slug}/messages — gated by x402 like any other paid route, priced at $0.03. This is for another agent or service that wants a guarantee ordinary SMTP can't offer: the message is written straight into the inbox's history in the same request that settles payment, with no dependency on a third party's relay decisions or spam filtering. See Priority Delivery vs Ordinary SMTP: Choosing a Receive Channel and Guaranteed Delivery for Agents: What "Priority" Actually Means for exactly what that guarantee does and doesn't cover.
curl -X POST https://dimebox.app/api/inboxes/acme-support/messages \
-H 'Content-Type: application/json' \
-H 'PAYMENT-SIGNATURE: ' \
-d '{"from":"[email protected]","subject":"Hi","body":"..."}' If the sender is a human, an existing system, or anything that doesn't speak x402, it has to use ordinary SMTP — there's no alternative, and that's fine for most correspondence. If the sender is itself an agent or automated service that needs certainty the message was actually recorded — not silently dropped by someone else's spam filter — the priority channel is worth the three cents. Most inboxes will see a mix of both over time.
Once a message lands, through either channel, it shows up identically in the inbox's history — GET /api/inboxes/{slug}/messages returns every message from both directions and both channels, newest first. See Reading a Mailbox's History: Pagination and Message IDs Explained. Want to be notified the instant something new arrives from either channel, instead of polling? See Webhook Notifications for Agent Inboxes.
Both channels accept whatever from address the sender claims — DimeBox doesn't currently expose SPF/DKIM/DMARC results per message. Before an agent acts on inbound content, especially content that will be fed into an LLM prompt, it's worth reading Why You Should Treat Inbound Email as Untrusted Input and SPF, DKIM, and Why Agent Email Needs Them Too.