How every send works. And every reply.
Resend-shape transactional API with agent-native features baked in: structured reply events as the primary primitive, per-agent reputation graph, native prompt-injection scanning, and deliverability infrastructure that auto-suspends bad actors before AWS sees them.
Every email you send goes through a classifier. Every reply your agent receives comes back as a structured object. This page explains both pipelines and why they work the way they do.
API → behavioral classifier → SES → recipient.
Every agent.send()hits a reputation classifier before it leaves our system — rules plus a lightweight LLM call to score the send for complaint-risk signals (recipient relationship, engagement history, content patterns, send-rate anomalies). Senders whose risk score spikes get auto-throttled until reputation builds, and suppression runs at send time so known-bad recipients never get a message. The classifier is invisible to your code — deliverability infrastructure, not a product axis you choose between.
Cleared sends flow through AWS SES on shared IPs by default. Customers on Scale+ can request a Dedicated IP add-on ($50/mo per IP) for reputation isolation — available on request, provisioned per request, with SES configuration sets and monitoring.
A per-sender complaint and bounce cron runs every 15 minutes. Any sender crossing 0.3% complaint rate auto-pauses before AWS's 0.5% threshold trips. Your agent's deliverability isn't affected by someone else's behavior. AWS SES underneath; a documented multi-vendor failover runbook (Postmark / SparkPost / Brevo, with a ~4-hour DNS swap path) lands in Phase 2 so a single-provider outage doesn't take your agent offline.
Replies arrive screened, scored, and structured.
Every inbound runs a six-category prompt-injection scan and a reputation check before reaching your agent. You write code against a structured event — injection score and sender reputation always present, intent and entities added when you enable classification.
injection_scoreAlways on. 0–1 prompt-injection risk. Refuse to act on high-score events before reading them.
sender_reputationAlways on. Per-agent reputation score for the sender's domain + identity.
intentOpt-in classification. Classified action — schedule_demo, request_pricing, unsubscribe, abuse_attempt, …
entitiesOpt-in classification. Structured data extracted from the body — dates, amounts, names, URLs.
urgencyOpt-in classification. 0–1 score. Threshold for paging your agent vs queueing for batch.
{
"id": "rep_01H8...",
"agent": "sarah",
"from": "user@example.com",
"subject": "Re: Demo",
"body": "Tuesday at 10am ET works...",
"injection_score": 0.02,
"sender_reputation": 0.91,
// Only present when classification is enabled on this agent:
"intent": "schedule_demo",
"entities": {
"date": "2026-05-14",
"time": "10:00",
"timezone": "America/New_York"
},
"urgency": 0.8
}Per-agent reputation graph.
Every agent on Mails.ai has its own reputation score — built from real engagement signals (reply rate, bounce rate, complaint rate, suppression hits, recipient sender-reputation lookups). The score is workspace-scoped: a bad agent loses verified-agent status across all your agents, enforced on every send rather than slipping through on a fresh identity.
An agent's reputation score is queryable via the mails.get_reputationMCP tool — customers see what we see for their own agents. The reputation score is also baked into the inbound structured reply event (event.sender_reputation), so your agent can refuse to act on senders with low scores even before content scanning kicks in.
Suppression is workspace-scoped — a complaint or unsubscribe suppresses the sender across your workspace, enforced on every send. Receiver-side verification API + browser extension ship in Phase 2 so recipients can confirm a sender is a real verified agent.
The technical questions.
How do you handle prompt injection in inbound email?
Every inbound runs a six-category injection scanner (boundary manipulation, system prompt override, data exfiltration, role hijacking, tool invocation, encoding tricks) BEFORE reaching your agent. Output: an injection_score (0–1) on the inbound event. Your agent code refuses to act on high-score events. Microsoft published RCE vulnerabilities via prompt injection in agent frameworks in May 2026. This is no longer optional infrastructure — included on every inbound at the base price.
Can I use my own domain instead of yourcompany.mails.ai?
Yes — on any paid plan. Add your domain in the dashboard and we return the DKIM, SPF and DMARC records to create at your own registrar. Records only: no nameserver move, and if you already publish SPF or DMARC we tell you to merge rather than replace, so your existing mail keeps working. Verify, then create agents on that domain and they send as agent@yourcompany.com, DKIM-signed with a key generated for your domain. One current limitation: custom-domain sends cannot yet reach Outlook and Hotmail recipients — mail from your workspace subdomain is unaffected.
What stops a customer from abusing the API to send spam?
Self-serve signup is not self-serve sending. (1) Every new workspace is manually reviewed before it can send — accounts default to not-approved, so a new signup can authenticate, create agents, and read/manage, but cannot send a single message until we approve it. (2) Free tier hard-capped at 3,000 events/month with email verification required. (3) Per-tier hourly + daily send caps in the billing layer. (4) A per-agent reputation classifier scores every send and suppression runs at send time. (5) Per-sender complaint cron auto-suspends anyone crossing a 0.3% rate — well before AWS's 0.5% threshold. (6) Per-agent reputation, isolated per workspace, enforced on every send.
What if AWS suspends your SES account?
Multi-vendor failover is documented as a launch-hardening requirement — a runbook to stand up backup senders (Postmark, SparkPost, Brevo) with a ~4-hour DNS swap path. The auto-suspend system already monitors per-sender complaint and bounce continuously, pausing anyone crossing 0.3% before AWS sees 0.5%, so reputation damage is contained well before a vendor escalates.
Built for agents.
Self-serve in minutes.
The API is live and self-serve. Drop ~6 lines into your agent and ship.
$ npm install @mailsai/sdk