How to Give an AI Agent an Email Address (2026 Guide)
You have six options. AgentMail is the easiest paid path. Nylas if you need to connect to existing Gmail/Outlook accounts. Composio Gmail MCP if you're in the Composio ecosystem. Self-hosted Postfix + Brevo if you want full control and an MTA you understand. Mailgun / Resend if you only need outbound. Ujex Postbox if you want self-hostable, Apache-2.0, with prompt-injection scoring built in.
An agent that can email is suddenly a real teammate. It can ask the human something async. Receive a confirmation. Send a status update. The infrastructure for this used to be three SaaS vendors plus your own webhook. In 2026 it's mostly solved — AgentMail raised $6M from Y Combinator in March specifically for this category, and most major providers have agent-aware offerings.
This guide walks all six options. Code samples included. Honest cost comparison.
What you actually need
| Capability | Why |
|---|---|
| Programmatic inbox creation | Per-agent or per-task addresses |
| Inbound parsing | Agent receives + reasons over real email |
| Outbound sending with DKIM/SPF/DMARC | Avoid spam folders |
| Webhook / push for new mail | Agent reacts in real time |
| Prompt-injection scoring | Email is a public input vector |
| Mobile approve-before-send | Human in the loop on outbound |
| API-first auth (no OAuth dance) | Agents don't have human sessions |
Option 1 — AgentMail
AgentMail is the YC-backed agent-native email provider. Show HN thread from August 2025 has thoughtful discussion. They charge per inbox + per message; free tier exists for testing.
// Create inbox
const r = await fetch("https://api.agentmail.to/inboxes", {
method: "POST",
headers: { "Authorization": "Bearer " + process.env.AGENTMAIL_KEY },
body: JSON.stringify({ display_name: "Task 47" })
});
const { address } = await r.json();
// → "task-47-abc123@agentmail.to"
// Webhook on inbound
app.post("/agentmail-webhook", (req, res) => {
const { from, subject, body } = req.body;
agent.respond({ from, subject, body });
res.sendStatus(200);
});
Pros: Easiest path. Webhooks just work. SPF/DKIM/DMARC handled. Cons: Paid at any non-trivial scale. Vendor lock-in.
Option 2 — Nylas
Nylas's guide for AI agents covers connecting agents to existing inboxes (Gmail, Outlook, Exchange, Yahoo, iCloud, IMAP) via OAuth. Different shape from AgentMail — your agent uses your mailbox, not its own.
// MCP server config (e.g. Claude Desktop)
{
"mcpServers": {
"nylas": {
"command": "npx",
"args": ["-y", "@nylas/mcp-server"],
"env": { "NYLAS_API_KEY": "..." }
}
}
}
Pros: Connects to existing accounts, six providers. MCP-native. Cons: Can't create new inboxes — agent uses your inbox. OAuth refresh complexity.
Option 3 — Composio Gmail MCP
Composio's Gmail toolkit wraps Gmail in a structured tool that Claude Code (and others) can invoke. Same OAuth-to-existing-inbox shape as Nylas, narrower scope.
Pros: If you already use Composio for other tools. Cons: Gmail-only.
Option 4 — Mailgun / Resend / Postmark
The classic transactional senders. They're great at outbound. Inbound parsing is supported by all three (Mailgun's "routes," Resend's "domains," Postmark's "inbound stream"). Per-agent inbox creation is not their model — you'd implement it on top.
Pros: Mature, reliable, good deliverability. Cons: Not agent-shaped — you build the per-agent layer yourself.
Option 5 — Self-hosted Postfix + OpenDKIM + Brevo relay
For the "I want to own this stack" case. Detailed runbook. The shape: Postfix on a Hetzner VM accepts SMTP on :25 (when port-25 is unblocked); OpenDKIM signs outbound; Brevo relays for inbox-placement; Cloud Function ingests POSTed messages into Firestore.
Pros: Full control. No vendor at the SMTP layer. Cons: A real mail server is a real thing to operate. Hetzner blocks port 25 by default; you ticket for unblock.
Option 6 — Ujex Postbox
Ujex Postbox is the open-source (Apache-2.0) version of options 1 + 5 combined: per-agent inbox API, DKIM/SPF/DMARC, prompt-injection scoring built in (heuristic + Gemini), mobile approve-before-send. Self-hostable on Firebase + Hetzner + Brevo. Free tier: 1 inbox, 50 messages/day.
from ujex_postbox import Postbox
pb = Postbox(api_key=os.environ["UJEX_API_KEY"])
# Create per-agent inbox
inbox = pb.create_inbox(local_part="task-47")
# → "task-47@yourdomain.dev"
# Listen for inbound
@pb.on_inbound("task-47")
def handle(message):
if message.pi_score > 0.7:
return # likely prompt injection — drop or escalate
agent.respond(message)
# Send outbound
pb.send(from_inbox="task-47", to="user@example.com",
subject="Task done", body="Here's the PR: ...",
require_approval=True) # mobile push to human
Pros: Self-hostable, Apache-2.0 SDKs, prompt-injection score built in, mobile approve-before-send. Cons: Newer than AgentMail. Self-host runs on Firebase + a single Hetzner VM.
Decision matrix
| AgentMail | Nylas | Composio | Mailgun | Self-host | Ujex Postbox | |
|---|---|---|---|---|---|---|
| Per-agent inbox creation | ✓ | ✗ | ✗ | Build it | Build it | ✓ |
| Connects to existing Gmail | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ |
| Inbound parsing | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Prompt-injection scoring | Some | ✗ | ✗ | ✗ | Build it | ✓ |
| Mobile approve-before-send | ✗ | ✗ | ✗ | ✗ | Build it | ✓ |
| Self-hostable | ✗ | ✗ | ✗ | Hybrid | ✓ | ✓ |
| Free tier | ✓ Limited | ✓ Limited | Limited | ✓ Limited | n/a | ✓ Generous |
What I'd pick
For a 1-hour weekend project: AgentMail. Free tier is generous enough.
For an agent integrated into a human's existing inbox: Nylas.
For an opinionated, self-hostable, full-stack setup with audit + budgets + memory in the same project: Ujex (which is exactly what we built — same Firebase project, replaceable boundaries).
FAQ
What's the cheapest option?
Self-host with Mailgun/Brevo's free tier — but the MTA itself is real labor. For zero ops, AgentMail's free tier or Ujex's free tier.
Can I keep my own domain?
AgentMail: bring-your-own-domain on paid plans. Nylas: you bring the user's existing inbox. Self-host / Ujex: yes — DKIM signing per your domain.
Does it work with MCP?
AgentMail has an MCP server. Nylas has an MCP server. Composio is MCP-native. Ujex publishes @ujex/postbox-mcp for Claude Desktop / Cursor / Cline / Zed.
Is the inbound parsing safe from prompt injection?
Email is a public attack vector. Treat every inbound message as untrusted text. Ujex Postbox runs prompt-injection scoring (heuristic regex + Gemini fallback) per inbound and exposes the score so your agent can route high-PI messages to a human approval queue. Other providers don't do this by default.