Built for teams who ship email in production
Every request is authenticated, rate-limited, and scoped to your account before it touches AWS SES.
Scoped API keys
Keys expire, rotate with a grace window, and revoke instantly. A revoked key and an unknown key return the same error.
Domain verification
2048-bit DKIM, SPF, and a dedicated MAIL FROM subdomain, verified through the same flow as the API.
Atomic rate limiting
Limits run as a single Redis script, so concurrent requests cannot race past your quota.
Header injection blocked at the schema
Every field that reaches a mail header is checked for carriage returns and control characters before it is accepted.
SSRF-safe webhook delivery
Webhook targets are resolved, checked against private ranges, and the verified IP is pinned for the actual connection.
Strict tenant isolation
Every query is scoped by account. Access to another account's resource returns 404, not 403.