Security on the sending side
One boundary first: this page is about securing mail you SEND. Inbound threat filtering, phishing detection on mail you receive, is a different product category entirely. Sender-side security is about two things: proving you are you, and making sure only intended mail leaves.
Proving you are you is domain authentication: SPF, DKIM, and DMARC, configured and aligned, so mailbox providers can verify every message. That's table stakes the platform sets up for you.
Making sure only intended mail leaves
The second half is control. API keys scoped and rotatable, so a leaked CI key doesn't own your whole account. Suppression lists enforced at the platform level, so no code path can accidentally mail an unsubscribed or bounced address. And the piece nobody else ships: a human approval gate in front of agent-staged sends, because an AI that can send unsupervised email is a liability with a rate limit.
Security here isn't a feature you enable. It's the shape of the platform: authenticated identity, bounded credentials, enforced suppression, human sign-off.
Least privilege is real work, and worth it. We once had a connection test that probed an endpoint requiring a broader scope, so a perfectly valid minimum-permission SendGrid key kept reporting as invalid. We rewrote the probe so any valid key passes and invalid ones still fail. That's the discipline scoped keys demand: the system must respect the smallest credential that can do the job.
Count the layers on the way out of our platform and you get eight: preflight checks, volume caps, warmup ramps, auto-pause on bounces and complaints, suppression lists, compliance injection, rate limits, and the human approval gate. The sending gate itself fails closed, so if a bug ever makes an account's status ambiguous, sending stops rather than risks. And the compliance footer, unsubscribe link and physical address, is injected by a system gate that custom branding cannot override. The mail that shouldn't leave, doesn't.
Full parameters and responses live in the REST API docs and the API reference.
Go deeper
The address-level half of trust: the email check API. The event side: secure your webhooks so forged events can't poison your data.