Most mainstream email platforms restrict or ban crypto senders, and it is rarely about legality. Mailchimp and Klaviyo prohibit the category in the acceptable-use policy, SendGrid and Mailgun review it case by case, and Amazon SES will generally carry lawful crypto mail after a review. The category attracts phishing, so receiving networks scrutinise it, and promotional crypto mail generates above-average complaint rates. On shared IP pools those complaints land on every other customer, so providers manage the risk by restricting the whole category rather than assessing individual senders.
That distinction matters, because it tells you what actually solves the problem. A dedicated SMTP server removes the provider policy, since there is no shared pool to protect. It does not remove CAN-SPAM, GDPR, the FCA promotion rules, or the receiving networks' own thresholds.
Who permits what, and how it is enforced
Policies move, so get confirmation in writing before you pay for anything. The enforcement column matters more than the policy column, because "restricted" usually means a silent review that ends in a paused account on your busiest day.
| Provider | Transactional crypto | Promotional crypto | How it is enforced |
|---|---|---|---|
| Amazon SES | Generally yes, subject to review | Case by case | Production access review, automatic pause on complaint spikes over 0.1% |
| Mailgun | Case by case | Restricted | Account review at signup, proof of consent requested later |
| Postmark | Transactional only by design | No | Bulk or promotional content on a transactional stream ends the account |
| SendGrid | Case by case | Often restricted | Compliance review, promotional crypto usually declined |
| Mailchimp | Restricted | Prohibited | Named in the acceptable-use policy, closed on report |
| Klaviyo | Restricted | Prohibited | Listed as a restricted business, approval can be withdrawn later |
| Dedicated SMTP | Yes, IPs are yours | Yes, subject to law | No provider policy, receiver rules and the law still apply |
The pattern is consistent: transactional mail is broadly accepted, promotional mail is where the restrictions bite. Account confirmations and security alerts are expected mail. Token launches and trading promotions are not. The same split shows up in forex and trading and in iGaming, for the same reason.
One warning about the review process. On SES and Mailgun, approval at signup is not permanent. Both re-review when volume jumps or complaints move, and a paused account pauses your 2FA codes along with your newsletter unless the streams are separated at the infrastructure level.
Split transactional from promotional, always
This is the single highest-value structural decision for a crypto sender, and it needs to happen before the first send, not after the first suspension.
| Stream | Subdomain | Contains | Complaint risk |
|---|---|---|---|
| Security | tx.yourdomain.com | 2FA codes, login alerts, withdrawal confirmations, password resets | near zero, target 0.02% |
| Account | account.yourdomain.com | KYC status, deposits, statements, support replies | very low |
| Marketing | news.yourdomain.com | product updates, launches, campaigns | this is where it lives, cap at 0.1% |
Separate subdomains, separate DKIM selectors, separate DMARC records, separate IPs. On a 3-IP starter setup that maps cleanly: one IP for security, one for account, one for marketing.
The reason is containment. If a promotional campaign generates complaints, the damage stops at the marketing subdomain and your withdrawal confirmations keep landing. Mixing them means one bad campaign can stop a security alert reaching a user, which in this sector is a safety failure rather than a marketing one. A user who does not see the "withdrawal requested" mail cannot cancel a withdrawal they did not authorise. See subdomain vs root domain for email sending for the DNS layout.
Throughput for time-critical mail
Security and price-alert mail is what breaks shared relays. The window is set by the event, not by your sender, so the maths is fixed.
| Batch | Window | Required rate | Per IP across 3 IPs |
|---|---|---|---|
| 10,000 security alerts | 2 min | 84 msg/s | 28 msg/s |
| 50,000 security alerts | 5 min | 167 msg/s | 56 msg/s |
| 200,000 price alerts | 10 min | 334 msg/s | 111 msg/s |
| 500,000 price alerts | 15 min | 556 msg/s | 186 msg/s |
A tuned Postfix or PowerMTA instance on 3 dedicated IPs handles the 50,000-in-5-minutes case comfortably. The real ceiling is on the receiving side, because Gmail and Microsoft throttle per connecting IP, so spreading a burst across IPs is what keeps the 4xx deferral rate down. Mid-tier shared relays often cap at a few hundred messages a minute, which turns a 5-minute security run into an hour and makes the alert useless.
Two operational rules for this stream. Keep it strictly transactional, so engagement stays high and complaints stay near zero. And set a hard time-to-live on the queue: if a price alert has not delivered inside its window, drop it rather than deliver a stale price at 3am and collect a complaint. Email queue and retry explained covers how to set that up.
Compliance that does not go away with your own server
Dedicated infrastructure removes the shared-pool policy conflict. It does not touch the law, and in this sector the law is moving fast.
| Requirement | What it means in practice | Where it applies |
|---|---|---|
| CAN-SPAM | accurate headers, physical postal address, working opt-out honoured within 10 business days, up to $53,088 per email | US |
| GDPR and PECR | provable opt-in consent for marketing, no pre-ticked boxes, consent record stored next to the address | EU and UK |
| MiCA marketing rules | cryptoasset service providers must keep marketing communications fair, clear and not misleading, and identifiable as marketing | EU |
| FCA financial promotion regime | promoting qualifying cryptoassets to UK consumers requires risk warnings, a cooling-off period for first-time investors, and approval by an authorised person | UK |
| CASL | express or implied consent, sender identification, working unsubscribe | Canada |
| No investment advice framing | avoid guaranteed-return language, price predictions and "risk-free" claims in any market | everywhere |
The FTC's CAN-SPAM compliance guide sets the US baseline and is short enough to read in full. The financial promotion side is the part that gets crypto firms in trouble, because a marketing email that reads like advice is treated as a promotion even when you did not intend it that way.
Transactional mail to existing users generally sits outside the promotion rules, which is one more reason to keep the streams separate. A withdrawal confirmation is not a financial promotion. A withdrawal confirmation with a "stake your balance for 12% APY" banner underneath it probably is.
This is not legal advice. Get it checked per market before you run a promotional campaign.
What it costs at 100K and 1M a month
Crypto senders scale in steps, because a token launch or a volatility spike can multiply alert volume overnight. Price both tiers before you choose.
| Provider | 100K per month | 1M per month | Dedicated IP | Policy risk |
|---|---|---|---|---|
| Amazon SES | about $10 plus $24.95 per IP | about $100 plus $24.95 per IP | add-on | review, pauses on spikes |
| Mailgun | roughly $75 to $90 | roughly $600 to $900 | higher tiers only | case by case |
| SendGrid | roughly $35 to $90 | roughly $700 to $1,500 | high tier only | restricted |
| Postmark | roughly $115 | not offered for bulk | no | transactional only |
| Dedicated server | $549 one-time plus $30 to $80 hosting | same server, same price | 3 included | none from a provider |
SES is the cheapest bill on paper and a reasonable choice if you have in-house deliverability staff. The cost is that you own warm-up and monitoring anyway, and an automated review can pause security mail on the day a market moves. At 1M a month the dedicated server is the cheapest option by a wide margin and the only one where nobody else's policy decides whether your 2FA codes send. The full arithmetic is in cost to send 1 million emails per month.
Deliverability specifics for crypto
DMARC at p=reject is close to mandatory here. Crypto brands are among the most impersonated targets on the internet. A domain at p=none lets a criminal send a perfect fake "confirm your withdrawal" from your exact From address, and Gmail will deliver it. RFC 7489 defines three policies: none asks for no action, quarantine asks receivers to treat failures as suspicious, and reject asks them to drop the forgery during the SMTP transaction. Only reject stops the phish. Start at none, read the aggregate reports for two to four weeks, move through quarantine, then reject. The path is in DMARC none vs quarantine vs reject.
Keep complaints under 0.1%. Google's bulk sender guidelines set 0.3% as the hard limit and recommend staying under 0.1%, and require SPF, DKIM and DMARC for any domain sending over 5,000 messages a day to Gmail, plus valid forward and reverse DNS and TLS. In a category filters already distrust, treat 0.1% as the ceiling for marketing and 0.02% for security mail.
No link shorteners, ever. bit.ly and similar are used constantly in crypto phishing, so they carry a filter penalty in this category that they do not carry elsewhere. Use your own tracking subdomain. The same goes for raw wallet addresses in promotional mail, which pattern-match to scam templates.
Content patterns matter more than average. Urgency language, countdowns, guaranteed yields and "act now" framing all score badly here. Write security mail plainly and put the risk language in text, not an image.
BIMI is worth considering once you are at reject. A BIMI record puts your verified logo next to the sender name in Gmail and Yahoo, which helps users tell your real security alert from the copies. It needs a Verified Mark Certificate at roughly $1,500 a year, so treat it as a brand decision. See what is BIMI and do you need it.
Why dedicated infrastructure fits this category
The core problem with shared pools for crypto senders is not technical, it is policy: you are a risk to the provider's other customers, so you get restricted regardless of how carefully you send. A clean exchange with a 0.01% complaint rate gets the same acceptable-use treatment as a token spammer.
Dedicated IPs remove that. There are no other customers to protect, so there is no category ban to run into, and your reputation reflects your own behaviour rather than the sector's average. For a sender doing everything correctly in a category with a poor average, that is a real advantage.
The trade is the usual one: you own warm-up, monitoring and list hygiene, and poor list quality has nowhere to hide. Budget 4 to 8 weeks of warm-up before full volume, ramping roughly 30% every two days per IP. How long does IP warm-up take has the schedule.
What to do after a termination
- Export while you still can. Suppression lists, bounce logs, complaint reports, DKIM keys. Access usually closes within 48 hours of the notice.
- Find the real cause. Complaint rate over 0.1%, bounce rate over 5%, or the category itself. The notice names one, the stats confirm which.
- Check domain reputation. Google Postmaster Tools, domain and IP separately. A Low or Bad domain reputation follows you to the next provider.
- Clean before you move. Drop hard bounces and anyone with no engagement in 12 months. That typically removes 20 to 30% of a crypto list.
- Rebuild on dedicated IPs. Fresh subdomains for each stream, SPF, DKIM, DMARC at
p=none, matching PTR records. - Warm up over 4 to 8 weeks. Security mail first because engagement is highest, then account, then marketing.
- Do not open a replacement account. Providers link by domain, payment method and sending pattern, and a second closure damages every later appeal.
The step most people skip is four. An airdrop list that got a Mailchimp account closed will get dedicated IPs listed on Spamhaus inside a week.
How BulkEmailSetup helps
We build dedicated SMTP infrastructure for senders in restricted categories: your own server, your own IPs, full SPF/DKIM/DMARC/PTR configuration, MTA tuning for burst throughput on alert traffic, bounce handling and a warm-up plan, with security, account and marketing streams separated onto their own subdomains and IPs from day one.
No shared pool means no category policy weighing your sending against other customers' risk. Meeting CAN-SPAM, GDPR and the financial promotion rules in your markets remains yours. Basic starts at $549 one-time, covering 1 SMTP server, 3 dedicated IPs, 25,000 emails/day and unlimited contacts. Higher tiers scale to 15 IPs and 200,000 emails/day. See pricing, or SMTP for SaaS transactional email for how the transactional side is normally structured.
Frequently asked questions
Which SMTP providers allow crypto companies?
Policies change often, so verify in writing before paying. Amazon SES generally permits crypto transactional mail subject to review, Postmark and Mailgun handle transactional crypto case by case, and Mailchimp, Klaviyo and several marketing platforms restrict or prohibit it outright. Most restrictions target promotional and token-offering content rather than account and security notifications.
Why do email providers restrict crypto senders?
Two reasons. Crypto attracts a high volume of phishing and fraud, so receiving networks scrutinise the category heavily, and complaint rates from promotional crypto mail run above average. On shared IP pools those complaints damage every other customer, so providers manage the risk by restricting the category rather than by policing individual senders.
Can crypto companies send transactional email reliably?
Yes, and it is much easier than promotional mail. Account confirmations, security alerts, withdrawal notifications and 2FA codes are expected mail that recipients look for, so engagement is high and complaints sit near 0.02%. Keep transactional mail on a separate subdomain and separate IPs from any marketing, and it will perform normally.
What compliance rules apply to crypto email marketing?
The general rules apply: CAN-SPAM in the US with penalties up to $53,088 per email, GDPR and PECR in the EU and UK, CASL in Canada. On top of those, financial promotion rules may apply depending on what you market and where. In the UK, promoting qualifying cryptoassets to consumers falls under the FCA financial promotion regime, and in the EU the MiCA regulation sets marketing-communication rules for cryptoasset service providers. Take advice for your jurisdiction before sending promotional crypto mail.
Do crypto companies need dedicated IPs?
If you send at any real volume, yes. Dedicated IPs remove the shared-pool policy problem entirely, because your sending no longer poses a risk to other customers of a provider. It also means your reputation reflects your own behaviour rather than the category's, which matters in a category receiving networks already treat with suspicion.
How fast does a crypto security alert need to send?
Fast enough that the user can still act. A withdrawal or login alert to 50,000 users inside 5 minutes needs about 167 messages per second, which is roughly 56 per second across 3 dedicated IPs. Many shared relays cap throughput on mid tiers, so check the ceiling in writing before you commit to one for security mail.
What happens to my crypto list after an ESP terminates the account?
Export suppression lists, bounce logs and DKIM keys immediately, because access often closes inside 48 hours. Then check Google Postmaster Tools for your domain reputation, clean the list, and rebuild on dedicated IPs with a fresh subdomain and a 4 to 8 week warm-up. Do not open a replacement account under a new name, since providers link by domain and payment method.
