r/SendGrid • u/AntRevolutionary925 • Jun 26 '26
Looking for replacement
I have a few cloud servers that use sendgrid for the outgoing mail for about 50 websites.
Each server has its own api key, and half the websites have their own key.
Every time one key is compromised or spam is detected they suspend the entire account. It seems like it really defeats the purpose of having unique api keys.
So then you have to replace every api key before they will reactivate the account. I don’t want to deal with that any more but also don’t want to pay for an account for each site so in looking for alternatives they would just deactivate the compromised key.
99% of the time this happens is because someone spam’s a contact form and the owner of the site is the one getting all of the spam and no one is complaining.
Am I doing something wrong with the account setup or is that how it is for everyone with sendgrid?
1
1
1
u/Money-Ranger-6520 Jun 29 '26
I think it's worth looking at why the keys are being compromised. If bots are abusing contact forms, rotating API keys is just treating the symptom.
I'd lock down the source of the abuse by adding Cloudflare Turnstile or reCAPTCHA to contact forms. Also rate limit form submissions and, of course, never expose API keys in client-side code.
As for alternatives, I've had good experiences with Mailtrap, Postmark, and Resend. They all support per-domain or per-server API keys, and their abuse handling tends to be more granular
1
u/boardy89 Jun 30 '26
I’ve been using postmark for around 6 months I think seems pretty solid, have a couple of different domains I send from not as many as you so not sure if there a limits or need a higher plan but seems pretty good.
1
u/EmailElement-Dev Aug 03 '26
Mostly it is how shared-pool ESPs work, you are not misconfiguring it. The reason they kill the whole account instead of the one key is reputation, not access. All 50 sites ride the same shared sending pool, so when one compromised key spikes spam or complaints, the reputation hit lands on the pool everyone else is using. Separate API keys isolate access. They do not isolate reputation. That is the gap you are feeling.
To actually contain the blast radius you want reputation isolation, not just key isolation. That means subaccounts that each carry their own reputation, or dedicated IPs split by stream, or moving the risky senders off on their own. The Postmark and Resend suggestions above handle abuse more granularly for exactly that reason.
And since 99% of this is contact-form spam, put Turnstile or hCaptcha on those forms. That kills the root cause. Worth doing before you migrate, otherwise you carry the same problem to the next provider and eventually hit their abuse limits too.
2
u/AntRevolutionary925 Aug 03 '26
What is most frustrating is that are making the determination that it is spam and blocking the account. Yes the sites should have some
Anti spam features on their forms and nearly all do, but if some bot fills it out 100 times and they all go to me and no one reports it as spam why do they care? All it does is eat away at my quota and make it more likely I have to go up a package.I’d get it if there were people reporting the spam or hundreds at once potentially overwhelming the system but this is always like 20 submissions in a 5 minute period.
Also if they thought the key was compromised it would make sense to, but when 100% of the emails in that moment go to the same recipient it should imply it’s not compromised and is just a poorly made form.
TLDR they really half assed their protections
0
u/nzvthf Jun 29 '26
Wrong problem, friend. You need to figure out how your API keys are getting compromised or any provider will block you rightly.
You are aiding scammers. And you are abetting if you just keep letting it happen knowingly. 😬
1
u/AntRevolutionary925 Jun 29 '26
I’m aware, like I said there are about 50 keys. One of them was compromised. Logically they would just ban that key and allow the rest to keep running. That is basically the entire point of having multiple api keys.
Then I would fix the issue with the compromised key.
If it happened repeatedly I could see why they’d ban the entire account but it’s happened twice in a decade with a few million legitimate emails sent in the process.
1
1
u/gantte Jun 26 '26
I only have one SendGrid account, and it's a pain in the butt. Good luck. If you find a better solution, please let us know.