How we prevent abuse

Any service that sends mail on behalf of other people can be used to send mail nobody asked for. Most of what follows is not policy but mechanism: things a customer cannot opt out of, because they are enforced by the system rather than promised by us.

You cannot send from a domain you have not proven

Adding a domain gives you three DNS records to publish: a DKIM key, an SPF record, and an MX record for bounces. Until all three resolve, the account cannot send from that domain at all — there is no manual override and no approval queue to talk our way past.

This is what makes impersonation structurally impossible rather than merely forbidden. Nobody can send as your domain through this platform without first editing your DNS.

Every domain gets its own signing key

We generate a 2048-bit RSA DKIM key per domain, and the private half never leaves us. One customer's reputation is therefore cryptographically their own: a domain that draws complaints cannot damage the standing of anyone else signing with a different key.

Bounces and complaints suppress an address automatically

Delivery events arrive from the sending backend over a signed notification channel, pinned to a single topic so a validly signed message from somebody else's account cannot be replayed at our endpoint. A hard bounce or a spam complaint writes a suppression for that account there and then.

Suppression is checked on every send, whatever route it came in by — API, SMTP, or a newsletter to a list. A suppressed address is recorded as skipped rather than attempted, so a customer working from a stale list cannot keep hitting an address that already complained.

Unsubscribing does not depend on the sender

Bulk messages carry the one-click unsubscribe header that Gmail and Yahoo require of bulk senders, handled by us rather than by the customer's own footer link. A recipient who uses it is removed from that list and suppressed for the account, without needing to load the sender's site or find a preferences page.

A new account cannot send very much

Signing up gets you ten messages, and that is a lifetime allowance rather than a monthly one. It is enough to verify a domain and watch a real message arrive, and not enough to be worth acquiring an account for. Paid plans require a card, which puts a name behind the sending.

Sending is rate limited per account

Each account has its own throughput ceiling, and the dispatcher claims work in bounded batches so that one customer's large send moves in slices instead of occupying the queue. Bulk mail is limited more tightly than transactional, and the two run on separate domains, so a newsletter that draws complaints cannot drag somebody's password resets down with it.

Reporting abuse

Mail you did not ask for, sent through us, is something we want to know about. Write to abuse@pigeonatlas.com and include the full headers if you can — they identify the sending account, which is the first thing we need in order to act.

What we may do about it, and what customers agree to when they sign up, is set out in the Acceptable Use Policy.