Email API Security
Security is foundational to every layer of the QueenSMTP.COM platform. From key generation to event delivery, each component is designed to protect your data, your recipients, and your sending reputation.
API Key Management
API keys are generated in your dashboard and can be revoked or rotated at any time without downtime. We recommend creating separate keys for each environment — development, staging, and production — so that revoking a compromised key in one environment does not disrupt the others. Keys are stored using one-way hashing on our servers, which means even in the unlikely event of a data breach, raw key values cannot be recovered.
Domain-Scoped Keys
Each API key can be scoped to one or more verified sending domains. A domain-scoped key can only send from addresses that belong to its authorised domains, preventing misuse if a key is accidentally exposed. This granular scoping also simplifies compliance audits by clearly linking each key to a specific business unit, product line, or client.
IP Allowlisting
For an additional layer of protection, you can restrict each API key to a set of approved IP addresses or CIDR ranges. Requests originating from any other IP are rejected with a 403 Forbidden response before they reach the sending pipeline. IP allowlisting is especially valuable for production keys that should only be used from known server infrastructure, eliminating the risk of key misuse from unauthorised networks.
TLS-Only Connections
All communication with the QueenSMTP.COM API and SMTP endpoints is encrypted using TLS 1.2 or higher. Plaintext connections are refused at the network level. This ensures that API keys, email content, and recipient data are never transmitted in the clear, meeting the encryption requirements of GDPR, HIPAA, and SOC 2 compliance frameworks.
Webhook Signatures (in development)
When webhooks ship, every payload will be signed with HMAC-SHA256 using a per-endpoint secret. The X-QueenSMTP-Signature header will carry t=<unix>,v1=<hex>, where v1 is the HMAC of t + "." + rawBody. Verify it, and reject timestamps older than five minutes, before processing an event.
Key Usage Tracking
Each API key records when it was last used and how many requests it has made, and can be revoked or regenerated instantly from your dashboard. Every message you send, and every one we refuse, is listed in your message log with its status and reason.