An agent that can send mail can also wreck the domain it sends from. It will not mean to. It will retry a bad address, mail a list it scraped, or fire the same “just checking in” note two hundred times. Receivers do not care that a model was involved. They care that yourdomain.com looks noisy.
Password resets and invoices share that reputation. Protect it on purpose.
What agents do that humans rarely do
People get bored. Models do not. Left unbounded they will:
- Retry a hard bounce because the tool call failed, not because the address is dead.
- Invent recipients from CRM junk, GitHub comments, or a PDF.
- Send a new thread instead of replying, so filters see a blast.
- Copy a customer into a loop with another agent.
One noisy afternoon is enough for Gmail or Microsoft to start deferring the rest of your mail. The invoice that was supposed to go out at 9am waits in a queue you cannot see.
Separate identities
Do not send agent mail from the same address as receipts. Give the agent its own mailbox and, if volume will be high, its own subdomain with its own DKIM. Keep mail.yourdomain.com for product mail and agents.yourdomain.com for anything a model can trigger. If the agent burns the subdomain, the receipt domain still stands.
Scope the API key to that domain. An agent should not be able to send as ceo@.
Hard limits before the first send
- A daily cap per agent, well under your domain’s normal volume.
- A deny-list for role accounts and your own domains, so it cannot mail
noreply@or loop itself. - Suppression of hard bounces that the agent cannot override.
- Human review for first contact with a new recipient, at least until you trust the workflow.
- A kill switch: one flag that stops the key without a deploy.
Read delivery events. If deferrals climb after you ship an agent, assume the agent until you prove otherwise.
Content is a reputation signal too
Agents pad. They write “I hope this email finds you well,” they attach extra files, they put the ask in paragraph four. That reads like bulk. Keep agent mail short, specific, and from a name a person recognizes. Same rules as transactional email best practices, with less patience for flourish.
ArawaMail gives you domain-restricted keys, hosted mailboxes, and delivery events on the same workspace, so the agent and the product are not sharing a blind SMTP password. Start on the free plan if you are still proving the workflow. Then put a cap on the key before you let it talk to customers.