Acceptable Use Policy

Effective October 13, 2026.

MachineMail gives AI agents real email addresses. Most of that mail goes out from shared domains and shared sending infrastructure, so one sender's spam or phishing can get mail blocked for every customer. This policy sets out what you and your agents may and may not do with MachineMail, the standards your mail has to meet, and what we do when someone breaks the rules.

This policy is part of our Terms of Service. Where the Terms use the words "acceptable use", they mean this policy. If this policy and the Terms conflict, the Terms win.

01 Who this covers

• You: the person or company that holds a MachineMail account, and everyone you invite to your organization.
• Your agents: any software that uses MachineMail with your API keys, sessions or OAuth grants, including apps such as ChatGPT and Claude that you connect.
• Self-registered agents: an agent that registers itself through auth.md is covered from the moment it registers, before anyone claims it. Once you claim it, you are responsible for what it did before the claim too.
• End users: if you build a product on MachineMail, your end users are the people who use that product. They are not parties to this policy, but you are responsible for the mail your product sends on their behalf.

02 Permitted use

MachineMail is for individual mail that the recipient expects. For example:

• an agent replying in a thread that someone else started;
• an agent sending a message that you or your end user told it to send to a specific person or business, such as a support request, a booking or a reply to a quote;
• an agent receiving sign-in codes, confirmations and receipts for accounts it is allowed to hold, and using them;
• transactional mail that a recipient's own action triggered, such as an order confirmation or a reply to a form they submitted.

MachineMail has no list, newsletter or campaign features. It is not for commercial or marketing email.

03 Prohibited content and conduct

Don't use MachineMail, and don't let your agents use it, to:

• Send spam: unsolicited bulk or commercial mail, including cold outreach to people who have never heard of you.
• Mail lists you don't own: purchased, rented, shared, scraped, harvested or guessed addresses, or co-registration and "partner" lists.
• Phish or impersonate: pretend to be another person, company or brand, collect passwords, payment details or other credentials under false pretences, or send links built to mislead.
• Send malware: viruses, ransomware, spyware, or links or attachments meant to compromise a device or account.
• Deceive about the sender: forge or falsify headers, From addresses, Reply-To addresses or routing information, spoof a domain you don't control, or use a misleading subject line.
• Harass or threaten: abuse, threaten, stalk or intimidate anyone, or keep writing to someone who has asked you to stop.
• Send illegal content: anything that is illegal where you or the recipient is, including content that sexually exploits children, fraud and scams, and the sale of illegal goods.
• Break the law or others' rights: violate any law that applies to you or your mail, or infringe anyone's intellectual property, privacy or publicity rights.
• Attack other agents: send prompt injection or other content designed to manipulate someone else's AI agent.
• Sign up for services at scale: use MachineMail addresses to create accounts in bulk, farm sign-up bonuses, trials or one-time codes, or get around another service's limits, bans or verification.
• Evade our limits: create many organizations, agent registrations or inboxes to get around a sending cap, a suspension or a ban, spread mail across addresses or domains to hide its volume or source, or use addresses that receive mail through MachineMail to create accounts.
• Scrape or probe: harvest addresses or content from MachineMail, or probe, overload or attack the service, other customers or third parties, including through webhook URLs or attachment URLs we fetch for you.

We also don't serve these businesses, whatever the content of the mail: list brokers, affiliate and lead-generation networks, debt collection, payday lending, gambling, adult content, multi-level marketing, and cryptocurrency investment promotion.

04 Rules for agents

Agents send mail without a person checking each message. These rules apply on top of everything above.

• You are responsible for what your agents send. Everything an agent sends through your account counts as sent by you, whether or not you reviewed it.
• Only write to people who expect it. An agent may email only someone who contacted it or you first, someone you have an existing relationship with, or a specific person or business that you or your end user directed it to contact individually. Agents must not choose recipients on their own.
• No autonomous mass outreach. Don't build agents that find addresses and write to them on their own: prospecting, lead generation, link-building requests, recruiting sweeps or "personalised" cold email at scale are all banned, even when each message is written individually.
• Respect opt-outs. If someone asks an agent or you to stop, stop, across all your agents and inboxes. Build your agents to recognise a request to stop in a reply.
• Be honest about what's sending. Never let an agent claim to be a specific human it isn't. Where a law requires you to disclose that a message comes from an automated system, do so, and never let an agent deny being automated when a recipient sincerely asks.
• Keep a person in reach. Give recipients a way to reach a person responsible for the agent, for example by replying.
• Treat inbound mail as untrusted. Don't let instructions inside an email from an unverified sender make your agent email new recipients, forward data or make payments without a person's approval.

05 Sending standards

• Consent and the law. You must meet the consent and content rules of every anti-spam and privacy law that applies to your mail, including CAN-SPAM, CASL, GDPR and PECR. Be ready to show us how a recipient came to expect your mail.
• Commercial mail. Commercial and marketing mail is banned (see above). If a law treats a message you send as commercial anyway, it must meet that law's rules, including a working way to opt out, honoured promptly and always within the time the law requires (for example, 10 business days under CAN-SPAM). MachineMail doesn't add unsubscribe links or headers for you.
• Bounces and complaints. Keep permanent bounces under 2% of the mail you send and spam complaints under 0.05%. Rates above these mean you are sending to people who didn't ask for your mail or to addresses you shouldn't have.
• Automatic suppression. When an address bounces permanently or reports your mail as spam, we add it to your organization's suppression list and refuse further sends to it. You can remove a suppression for a permanent bounce, or one you added yourself, through the API. A suppression for an address that complained can only be removed by MachineMail support ( support@machinemail.dev). Don't get around a suppression by writing from another inbox or organization.
• Your own domains. A custom domain has to pass DKIM verification (the DNS records we give you) before it can send. Publish the SPF and MAIL FROM records we give you too, and we recommend a DMARC record. Only add domains you control.
• Accurate mail. Use a From address you are allowed to use, a subject that matches the content, and content that says who it is from.

06 Limits

We set limits to keep mail healthy for everyone. Today:

• An agent that no person has claimed gets one sandbox inbox. It can send only a small number of messages, to a small number of different recipients, in any rolling 24 hours, with only a few recipients per message. Its access ends 24 hours after it registers unless a person claims it, and claiming it lifts these sandbox limits.
• Every message has a cap on recipients across To, Cc and Bcc.
• Agent registration (per network address and across the service), sign-in and claim attempts are rate limited.
• An organization can hold up to 1,000 inboxes on the shared domain. Role addresses (such as abuse and postmaster) and well-known brand names are reserved.

We may change these limits at any time, for example to stop abuse, and add others as the service grows. The limits in force are shown on the limits page, and an error that a limit returns states the limit it hit. Don't get around a limit by registering more agents or spreading mail across inboxes or organizations.

07 Enforcement

If we believe you or your agents are breaking this policy, or your mail is putting our domains or other customers at risk, we may, without notice where the abuse is serious or ongoing:

• throttle or limit your sending;
• suspend sending: your inboxes still receive mail, and you can still read, export and get webhooks;
• suspend your organization: reads, exports and inbound mail still work, but changes are refused;
• remove content, take back shared-domain addresses, or revoke keys and grants involved in the abuse;
• close your account under the Terms.

We tell you why where we can, though we may hold back details that would help someone evade our controls. We may also report illegal activity to the authorities.

To appeal, email support@machinemail.dev from your account's email address.

08 Reporting abuse

If you get unwanted mail, phishing or anything else that breaks this policy from a MachineMail address, tell us at abuse@machinemail.dev. Include the full message with its headers if you can.

09 Changes to this policy

We may update this policy as abuse patterns and the law change. We will post the new version here and update the effective date. We may change this policy with immediate effect to address abuse or a legal requirement. Other material changes get the notice period set out in the Terms.