Tutorial

How to Give an AI Agent an Email Address (2026 Guide)

Akshay Sarode
Direct answer

You have six options. AgentMail is the easiest paid path. Nylas if you need to connect to existing Gmail/Outlook accounts. Composio Gmail MCP if you're in the Composio ecosystem. Self-hosted Postfix + Brevo if you want full control and an MTA you understand. Mailgun / Resend if you only need outbound. Ujex Postbox if you want self-hostable, Apache-2.0, with prompt-injection scoring built in.

An agent that can email is suddenly a real teammate. It can ask the human something async. Receive a confirmation. Send a status update. The infrastructure for this used to be three SaaS vendors plus your own webhook. In 2026 it's mostly solved — AgentMail raised $6M from Y Combinator in March specifically for this category, and most major providers have agent-aware offerings.

This guide walks all six options. Code samples included. Honest cost comparison.

What you actually need

CapabilityWhy
Programmatic inbox creationPer-agent or per-task addresses
Inbound parsingAgent receives + reasons over real email
Outbound sending with DKIM/SPF/DMARCAvoid spam folders
Webhook / push for new mailAgent reacts in real time
Prompt-injection scoringEmail is a public input vector
Mobile approve-before-sendHuman in the loop on outbound
API-first auth (no OAuth dance)Agents don't have human sessions

Option 1 — AgentMail

AgentMail is the YC-backed agent-native email provider. Show HN thread from August 2025 has thoughtful discussion. They charge per inbox + per message; free tier exists for testing.

// Create inbox
const r = await fetch("https://api.agentmail.to/inboxes", {
  method: "POST",
  headers: { "Authorization": "Bearer " + process.env.AGENTMAIL_KEY },
  body: JSON.stringify({ display_name: "Task 47" })
});
const { address } = await r.json();
// → "task-47-abc123@agentmail.to"

// Webhook on inbound
app.post("/agentmail-webhook", (req, res) => {
  const { from, subject, body } = req.body;
  agent.respond({ from, subject, body });
  res.sendStatus(200);
});

Pros: Easiest path. Webhooks just work. SPF/DKIM/DMARC handled. Cons: Paid at any non-trivial scale. Vendor lock-in.

Option 2 — Nylas

Nylas's guide for AI agents covers connecting agents to existing inboxes (Gmail, Outlook, Exchange, Yahoo, iCloud, IMAP) via OAuth. Different shape from AgentMail — your agent uses your mailbox, not its own.

// MCP server config (e.g. Claude Desktop)
{
  "mcpServers": {
    "nylas": {
      "command": "npx",
      "args": ["-y", "@nylas/mcp-server"],
      "env": { "NYLAS_API_KEY": "..." }
    }
  }
}

Pros: Connects to existing accounts, six providers. MCP-native. Cons: Can't create new inboxes — agent uses your inbox. OAuth refresh complexity.

Option 3 — Composio Gmail MCP

Composio's Gmail toolkit wraps Gmail in a structured tool that Claude Code (and others) can invoke. Same OAuth-to-existing-inbox shape as Nylas, narrower scope.

Pros: If you already use Composio for other tools. Cons: Gmail-only.

Option 4 — Mailgun / Resend / Postmark

The classic transactional senders. They're great at outbound. Inbound parsing is supported by all three (Mailgun's "routes," Resend's "domains," Postmark's "inbound stream"). Per-agent inbox creation is not their model — you'd implement it on top.

Pros: Mature, reliable, good deliverability. Cons: Not agent-shaped — you build the per-agent layer yourself.

Option 5 — Self-hosted Postfix + OpenDKIM + Brevo relay

For the "I want to own this stack" case. Detailed runbook. The shape: Postfix on a Hetzner VM accepts SMTP on :25 (when port-25 is unblocked); OpenDKIM signs outbound; Brevo relays for inbox-placement; Cloud Function ingests POSTed messages into Firestore.

Pros: Full control. No vendor at the SMTP layer. Cons: A real mail server is a real thing to operate. Hetzner blocks port 25 by default; you ticket for unblock.

Option 6 — Ujex Postbox

Ujex Postbox is the open-source (Apache-2.0) version of options 1 + 5 combined: per-agent inbox API, DKIM/SPF/DMARC, prompt-injection scoring built in (heuristic + Gemini), mobile approve-before-send. Self-hostable on Firebase + Hetzner + Brevo. Free tier: 1 inbox, 50 messages/day.

from ujex_postbox import Postbox
pb = Postbox(api_key=os.environ["UJEX_API_KEY"])

# Create per-agent inbox
inbox = pb.create_inbox(local_part="task-47")
# → "task-47@yourdomain.dev"

# Listen for inbound
@pb.on_inbound("task-47")
def handle(message):
    if message.pi_score > 0.7:
        return  # likely prompt injection — drop or escalate
    agent.respond(message)

# Send outbound
pb.send(from_inbox="task-47", to="user@example.com",
        subject="Task done", body="Here's the PR: ...",
        require_approval=True)  # mobile push to human

Pros: Self-hostable, Apache-2.0 SDKs, prompt-injection score built in, mobile approve-before-send. Cons: Newer than AgentMail. Self-host runs on Firebase + a single Hetzner VM.

Decision matrix

AgentMailNylasComposioMailgunSelf-hostUjex Postbox
Per-agent inbox creationBuild itBuild it
Connects to existing Gmail
Inbound parsing
Prompt-injection scoringSomeBuild it
Mobile approve-before-sendBuild it
Self-hostableHybrid
Free tier✓ Limited✓ LimitedLimited✓ Limitedn/a✓ Generous

What I'd pick

For a 1-hour weekend project: AgentMail. Free tier is generous enough.

For an agent integrated into a human's existing inbox: Nylas.

For an opinionated, self-hostable, full-stack setup with audit + budgets + memory in the same project: Ujex (which is exactly what we built — same Firebase project, replaceable boundaries).

FAQ

What's the cheapest option?

Self-host with Mailgun/Brevo's free tier — but the MTA itself is real labor. For zero ops, AgentMail's free tier or Ujex's free tier.

Can I keep my own domain?

AgentMail: bring-your-own-domain on paid plans. Nylas: you bring the user's existing inbox. Self-host / Ujex: yes — DKIM signing per your domain.

Does it work with MCP?

AgentMail has an MCP server. Nylas has an MCP server. Composio is MCP-native. Ujex publishes @ujex/postbox-mcp for Claude Desktop / Cursor / Cline / Zed.

Is the inbound parsing safe from prompt injection?

Email is a public attack vector. Treat every inbound message as untrusted text. Ujex Postbox runs prompt-injection scoring (heuristic regex + Gemini fallback) per inbound and exposes the score so your agent can route high-PI messages to a human approval queue. Other providers don't do this by default.