Resend removed the upfront approval form for sending email and absorbs the phishing risk on its own infrastructure, chief executive Zeno Rocha told Latent Space, a remote signup decision that exposes Gmail, Outlook and Yahoo inboxes to instant abuse.
Rocha said Resend was powering 4.3 million users and 120,000 paid customers as of the recording, including Warner Brothers and HBO. He came from front end work and the Dracula theme and said Mailgun, Mailchimp and SendGrid served marketers while developers got friction. The platform is described in third party overviews as a developer focused transactional email API with React Email integration for startup engineering teams. That premise became no forms and no two day human review, with throttles and reputation checks applied after signup.
Then a Japanese group showed up with 20,000 domains registered across different registrars, Rocha said.
Those accounts used domains bought two days earlier, missing websites or lookalike outreach domains, then blasted at once and went silent, which is exactly what Gmail throttles. Resend spaces sends in queues, puts engaged recipients first, watches opens, archives and deletes to decide how fast to release the rest, and spreads load across IP blocks and pools with separate histories. It blocks fast on bounce and complaint signals, then talks to the sender because Rocha said most cases are misuse rather than deliberate abuse. Product checks for links, spelling and sending patterns sit before send, and plain text is auto generated from HTML markdown to make spam filter parsing easier and lift deliverability.
Open tracking is weak now because Apple preloads images for privacy and summaries, Rocha said, so clicks matter more but only if link and image domains match the sending domain. Resend first rewrote links to its own domain like others do, then learned that one bad neighbor can blacklist shared tracking domains for days or weeks. DNS remains the support sink, with users pasting wrong CNAME, A and TXT values and getting stuck, and the team pushed Domain Connect with Cloudflare and Vercel as an OAuth style fix after months chasing providers including GoDaddy.
Steady volume wins, so warm domains gradually, keep sending and link domains aligned, ship both HTML and plain text, and expect a fast block if burst patterns look like phishing.
