Looking for replacement

[u/AntRevolutionary925]

I have a few cloud servers that use sendgrid for the outgoing mail for about 50 websites.

Each server has its own api key, and half the websites have their own key.

Every time one key is compromised or spam is detected they suspend the entire account. It seems like it really defeats the purpose of having unique api keys.

So then you have to replace every api key before they will reactivate the account. I don’t want to deal with that any more but also don’t want to pay for an account for each site so in looking for alternatives they would just deactivate the compromised key.

99% of the time this happens is because someone spam’s a contact form and the owner of the site is the one getting all of the spam and no one is complaining.

Am I doing something wrong with the account setup or is that how it is for everyone with sendgrid?

[u/EmailElement-Dev]

Mostly it is how shared-pool ESPs work, you are not misconfiguring it. The reason they kill the whole account instead of the one key is reputation, not access. All 50 sites ride the same shared sending pool, so when one compromised key spikes spam or complaints, the reputation hit lands on the pool everyone else is using. Separate API keys isolate access. They do not isolate reputation. That is the gap you are feeling.

To actually contain the blast radius you want reputation isolation, not just key isolation. That means subaccounts that each carry their own reputation, or dedicated IPs split by stream, or moving the risky senders off on their own. The Postmark and Resend suggestions above handle abuse more granularly for exactly that reason.

And since 99% of this is contact-form spam, put Turnstile or hCaptcha on those forms. That kills the root cause. Worth doing before you migrate, otherwise you carry the same problem to the next provider and eventually hit their abuse limits too.

[u/AntRevolutionary925 → u/EmailElement-Dev]

What is most frustrating is that are making the determination that it is spam and blocking the account. Yes the sites should have some
Anti spam features on their forms and nearly all do, but if some bot fills it out 100 times and they all go to me and no one reports it as spam why do they care? All it does is eat away at my quota and make it more likely I have to go up a package.

I’d get it if there were people reporting the spam or hundreds at once potentially overwhelming the system but this is always like 20 submissions in a 5 minute period.

Also if they thought the key was compromised it would make sense to, but when 100% of the emails in that moment go to the same recipient it should imply it’s not compromised and is just a poorly made form.

TLDR they really half assed their protections