# Email provider suspended your account: what to do in the first 24 hours

> Your email provider suspended your account? Why it happens, an hour-by-hour plan for the first 24 hours and how to keep it from happening again.

Source: https://couryo.com/en/blog/email-account-suspended · Published 2026-10-20

Your app stopped sending email and nobody told you. You find out when a customer says their login code never arrived, you open your provider's dashboard and the account is suspended. Password resets, receipts, order confirmations: all stopped at once.

It happens at every major provider, and there is almost always a cause you can find and fix. This guide explains why providers suspend accounts, gives you an hour-by-hour plan for the first 24 hours and shows how to keep it from happening again. It applies to any sending service.

## Why providers suspend accounts

Mailbox providers (Gmail, Outlook, Yahoo) judge senders by their history. On an email service, many customers share the same infrastructure, so one customer sending spam hurts delivery for everyone. That's why providers watch two rates all the time:

- **Bounce rate:** emails that came back because the address doesn't exist. A high rate points to an old list, a bought list or one full of addresses typed by bots.
- **Complaint rate:** people who clicked "report spam". It's the signal mailbox providers take most seriously.

The outside thresholds are public. Google asks senders to keep the spam rate in Postmaster Tools **below 0.3%**, recommends staying below 0.1%, and requires one-click unsubscribe from anyone sending more than 5,000 messages a day to Gmail accounts ([Google's sender guidelines](https://support.google.com/a/answer/81126)). Microsoft started requiring SPF, DKIM and DMARC from senders of more than 5,000 emails a day to Outlook on May 5, 2025; non-compliant mail first goes to Junk and is then rejected with `550 5.7.515` ([Microsoft's announcement](https://techcommunity.microsoft.com/blog/outlook/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730)).

Sending providers pause well before those thresholds, to protect their other customers. Some publish their numbers (verified on October 20, 2026):

| Provider | Bounces | Complaints | What happens |
|---|---|---|---|
| [Resend](https://resend.com/docs/knowledge-base/account-quotas-and-limits) | under 4% | under 0.08% | above that, sending may be paused temporarily until the rate drops |
| [Postmark](https://postmarkapp.com/support/article/1111-does-postmark-have-a-daily-send-limit) | under 10% | under 0.1% | above that, the account is paused and messages wait in a queue |
| [Brevo](https://help.brevo.com/hc/en-us/articles/360017299259) | hard bounces above 2% (campaigns) | above 0.2% (campaigns) | the campaign and account can be suspended; unsubscribes above 1% count too |
| [Mailgun](https://documentation.mailgun.com/docs/mailgun/api-reference/lower-bounce-rate) | numbers not published | numbers not published | the domain is temporarily disabled; support re-enables it after the fix |

Knowing your provider's thresholds before trouble starts is half the prevention.

## Four real cases and what each one teaches

Public accounts from people who went through it, summarized. The point is not to blame anyone: in every case the provider was protecting its infrastructure, and the customer had a blind spot.

1. **Fake sign-ups in a multi-tenant SaaS.** A help desk SaaS had its whole account suspended twice in one week: bad actors created workspaces pretending to be real companies and used the ticketing feature to send fraudulent emails. Every legitimate customer lost email, and the founder only noticed when the app stopped sending ([post on r/SaaS](https://www.reddit.com/r/SaaS/comments/1x9ql91/resend_suspended_our_entire_saas_email_service/)). **Lesson:** if your users can trigger emails, their abuse becomes yours.
2. **A contact form hit by bots.** An agency with about 50 websites on one SendGrid account saw the whole account suspended whenever a key leaked or a contact form got spammed, and had to replace every key to get reactivated ([post on r/SendGrid](https://www.reddit.com/r/SendGrid/comments/1ug37tn/looking_for_replacement/)). **Lesson:** an unprotected form plus a single shared account turns a small problem into a full outage.
3. **The first newsletter.** A store that had used Mailgun for months without issues sent its first campaign, about 150 emails, above the free plan's limit. The account was flagged almost immediately and closed for good, even after upgrading ([post on r/webdev](https://www.reddit.com/r/webdev/comments/1u9g7cl/mailgun_alternative/)). **Lesson:** the first big campaign is the riskiest moment. Tell your provider and start small.
4. **Suspended right after paying.** A Brevo user paid for a plan and, 40 minutes later, was suspended for a 2% bounce rate and 3% unsubscribes on the first campaign ([comment on r/DigitalMarketing](https://www.reddit.com/r/DigitalMarketing/comments/1d5umi8/best_email_marketing_or_any_experience_with_brevo/mk59ex4/)). **Lesson:** campaign thresholds apply from the very first send, and 2% bounces on an imported list is easy to hit.

## The plan for the first 24 hours

### Hour 0 to 1: confirm and contain

- **Read the whole notice**, in the email and in the dashboard. Write down what was suspended (the account, one domain, only marketing?) and the stated reason.
- **Stop all marketing.** Scheduled campaigns, sequences and running imports. They make the rates worse while you investigate.
- **Rotate your API keys if there's any sign of a leak:** a spike you don't recognize, recipients at domains you've never used, sends in the middle of the night. Create new keys, one per system, and delete the old ones.
- **Tell your team and, if needed, your customers.** "Email delivery is degraded and we're on it" saves you a pile of duplicate tickets.

### Hour 1 to 4: find the cause, with numbers

A review request only moves with data. Gather:

- **Hard bounce rate over the last 24 hours:** hard bounces divided by emails sent. Break it down by campaign, list source and recipient domain.
- **Complaint rate over the last 7 days**, with the same breakdown.
- **Where the problem addresses came from:** a recent import, a form, sign-ups, one of your SaaS customers' API usage.
- **What changed in the last few days:** a new list, a new campaign, a deploy that touched sign-up, a new tenant in your SaaS.

Your provider's events (webhooks or a log export) have all of this. If the bounced addresses look like bots (random letters, disposable domains, sign-ups in rapid sequence), the cause is your form.

### Hour 4 to 12: clean the list

- **Remove** hard bounces and complainers. They never get email again.
- **Take unsubscribers off marketing**, but keep transactional email (password, billing) for them.
- **Set aside** contacts with no opens or clicks in more than 12 months. Ask them to reconfirm before mailing them again.
- **Delete** bot sign-ups and block their source.
- **Export your suppression list** and keep a copy. It's yours, and it's gold if you switch providers.

### Hour 12 to 24: request a review, with numbers

A good request answers, in a few lines, what happened, why, and what changed. Template:

> Our account was suspended on October 20 at 9am. The cause was an import of 3,200 old contacts in the October campaign: hard bounces reached 6.1% over the last 24 hours (196 of 3,200). Done so far: we removed those 196 addresses and every contact with no opens in 12 months (1,140), paused campaigns and rotated our API keys. Going forward: imported lists go through reconfirmation, and our sign-up form now has a captcha and double opt-in. We're asking to re-enable transactional email first (login, password and billing, about 400 a day) and will resume marketing only after 7 clean days.

Asking for transactional first, at a lower volume, is usually easier to approve than asking for everything at once.

## Protect forms and sign-ups from bots

Most suspensions that don't involve a bought list start with an open form.

- **A captcha** on sign-up, password reset and contact forms. Turnstile, hCaptcha and reCAPTCHA all have invisible modes that real people barely notice.
- **A honeypot field:** a field hidden with CSS. People leave it empty; bots fill it in. Dropping those submissions takes one line of code.
- **Rate limits** per IP and per email address. An example in Node with Express:

```js title="5 sign-ups per IP every 15 minutes"
import rateLimit from "express-rate-limit";

app.post("/signup", rateLimit({ windowMs: 15 * 60 * 1000, limit: 5 }), signup);
```

- **Double opt-in:** the first email is only the confirmation link. Welcome emails, newsletters and sequences wait until the person clicks.
- **Never offer "send me a copy" on a contact form.** It lets any bot send free text to any address from your domain.
- **In a multi-tenant SaaS:** cap invites and sends from new accounts in their first days, never put user-typed text (company name, ticket subject) into emails to third parties without a length limit and link filtering, and check the domain of whoever signs up.

## Don't depend on a single provider

Even when you do everything right, a plan B turns a suspension from "days without email" into "minutes to change an environment variable".

- **A sending layer in your code:** one `sendEmail()` function that calls the provider. Switching providers becomes a config change.
- **A second provider with your domain already verified**, carrying a small share of traffic (one low-volume flow, for example) to keep its reputation warm.
- **Transactional and marketing kept apart**, by stream, by key or even by provider. A newsletter problem must never take down login emails.
- **One key per system or per customer**, so a leaked key can be replaced without stopping the others.
- **Events stored in your own database**, through webhooks. If the provider goes down or suspends you, your history and suppressions stay with you.

## What a transparent policy looks like: Couryo's pauses

Read any provider's policy before you sign up. As an example of a public rule, this is Couryo's, published in its [acceptable use and pause policy](https://couryo.com/en/acceptable-use):

| Measure | Reduced limit | Marketing paused | Full pause |
|---|---|---|---|
| Hard bounces (24 hours, at least 50 sent) | above 2% | above 3% | above 10% |
| Complaints (7 days, at least 200 sent) | above 0.03% | above 0.05% | above 0.5% |

- **The steps are gradual.** First the daily limit is halved and everything keeps going out. Then only marketing stops, while password, login and billing emails keep going out at a reduced limit. A full pause is reserved for very high rates or clear fraud.
- **Every pause comes with the reason, the numbers and what to fix**, in the dashboard, by email and in the API response.
- **Review:** the **Request review** button runs an automated check right away against the account's numbers; if there's still doubt, a person answers within 1 business day.
- **Per-project pauses first:** in an account with several projects, only the project that crossed the line is affected ([limits and trust levels](https://couryo.com/en/docs/limits.md#pauses-per-project-first)).
- **A suspicious key is paused on its own**, without stopping the account, and you reactivate it in one click after checking ([paused keys](https://couryo.com/en/docs/limits.md#paused-keys)).

Use these questions to judge any provider: are the numbers public? Is there a step before a full shutdown? Do critical transactional emails keep going out during a pause? Who reviews, and how fast?

## FAQ

### How long does it take to get a suspended account back?

It depends on the provider and the cause, and few publish a timeline. A request with the cause, the numbers and the fix moves faster than "please reactivate us". At Brevo, a first campaign suspension can be lifted from the dashboard by following the Deliverability center's instructions ([Brevo](https://help.brevo.com/hc/en-us/articles/360017299259)); at Couryo, the automated review answers right away and a person within 1 business day. Fraud or repeat incidents can lead to closure. Meanwhile, route critical transactional email through a second provider.

### Can I open another account at the same provider to keep sending?

Don't. Splitting sends across accounts to get around a pause is usually against the terms of use (Couryo's [policy](https://couryo.com/en/acceptable-use) doesn't allow it either), and your domain, card and IP link the new account to the old one. You risk losing both.

### What bounce rate is acceptable?

The lower, the better. Published thresholds range from 2% (Brevo, on campaigns) to 10% (Postmark). If yours is above 2%, it's already over the strictest rule in the table and the list needs cleaning before the next send. Double opt-in at sign-up is what helps most to stay under it.

### Can a single spam complaint get my account suspended?

One alone rarely crosses the rate, but it can trigger a review on a new or low-volume account, because the rate is calculated over few sends. That's why a visible one-click unsubscribe is the best defense: people who want out click "unsubscribe" instead of "spam".

### Does switching providers fix the problem?

Only if the provider was the cause. If the cause is your list or an open form, the problem moves with you and the suspension happens again. Fix the cause first and bring your suppression list along. Our guide to [SendGrid alternatives](https://couryo.com/en/blog/sendgrid-alternatives-free-tier) compares the pause rules of six services.