CarlyEmail gives an AI agent a real mailbox. Not a webhook that pretends to be one: an address on a domain, with SPF, DKIM and DMARC, that people can write to from Gmail and that replies land back in.

An agent can create its own inbox mid-conversation, send from it, and read what comes back — without a human opening a dashboard first.

What makes it different

Sign-up returns a working key. POST /v0/agent/sign-up creates an organization, an inbox and an API key in one unauthenticated call. There is no dashboard step, which is what lets an agent bootstrap its own mailbox while it is running.

The key is deliberately weak until someone confirms the address. An unverified organization can read and organize its own mail but cannot send outward. Frictionless onboarding and the abuse gate are the same mechanism — see limits.

Inbound mail is authenticated, not just delivered. Every received message carries SPF, DKIM and DMARC verdicts from the receiving path. A message that fails is labelled unauthenticated and kept out of default listings rather than being dropped, because an agent acting on spoofed mail is the whole attack. See receiving.

Bounces and complaints suppress themselves. An address that hard-bounces or complains is added to a read-only suppression list for that organization and refused at send time. Reputation damage from one tenant does not become everybody's problem. See suppression.

Where things live

Unverified organizations send from a subdomain deliberately: it is a reputation surface that can be burned without taking the apex down with it.