How SMTPfast Uses AI to Keep Bad Actors Off the Platform

An email platform lives or dies on sender reputation. When a spammer gets onto shared infrastructure, the damage does not stop at their account: inbox providers score the source, and every legitimate customer sending from the same platform pays for it in deliverability. That makes the signup queue one of the most important security surfaces we operate.

So we built an AI screening layer for it. Applications for sending access on SMTPfast are now automatically researched, risk-scored, and summarized, powered by DigitalOcean's AI platform, so that by the time a person reviews an application, the research is already done.

What the system actually does

When an application arrives, the platform does what a careful analyst would do first:

• It checks the applicant's domain from the outside. Public DNS posture and registration data, the same evidence a human reviewer would pull up by hand, gathered automatically instead.
• It checks our own history. How earlier applications related to this one turned out is a signal no external service can offer, because it lives in our records alone. Only aggregate patterns are used, never other customers' identities.
• It weighs what the applicant submitted. The signup path and any context provided with the application, read together with everything above.

A language model running on DigitalOcean's serverless inference weighs that evidence and produces two things: a risk score from 0 (clearly legitimate) to 100 (near-certain abuse), and a short written assessment citing the signals behind the number. Not a black-box verdict: a score with its reasoning attached. Our review team sees both alongside the rest of the review queue.

Humans decide, AI does the legwork

The score is advisory by design. No application is rejected by a machine, and no application is approved by one either. What the AI changes is the quality and speed of human review: instead of starting every application cold, the team starts from a researched brief, and attention goes to the genuinely ambiguous cases.

We think this is the right division of labor for trust decisions. Models are good at collecting evidence and noticing patterns across weak signals. Accountability belongs with people. A false positive here would be a real developer waiting longer than they should for access, so the system is built to inform judgment, not replace it, and assessments can be re-run as new information arrives.

Why DigitalOcean's AI platform

We run production email infrastructure; we did not want to also run GPU infrastructure. DigitalOcean's serverless inference gives us an OpenAI-compatible endpoint, a menu of models from multiple providers behind one API, and per-token pricing. The integration is small, and swapping models is a configuration change, so we can keep evaluating candidates without rewriting anything. Screening at our volume costs pennies, which means there is no economic pressure to cut it back.

What this means if you are a customer

Nothing changes in your workflow, and that is the point. This work exists to keep shared infrastructure clean and to defend sending reputation at the front door, before a problem ever reaches an IP you send from. Trust and safety is not a feature you use. It is a property of everything else working.

We will keep publishing how we build these systems. If you are evaluating email providers, one question worth asking any of them: what keeps bad actors off your platform?