Most email service providers don't let you control how your emails are actually sent. You write the content, pick the recipients, hit send — and behind the scenes, your email goes through their infrastructure, their IPs, their SendGrid subuser, their domain. Your reputation is tangled up with every other customer on the platform.
This is fine until it isn't. And when it isn't, you have no leverage.
The shared infrastructure problem
When an ESP sends email on your behalf, they typically pool multiple customers onto shared sending infrastructure. Shared IP addresses. Shared SendGrid subusers. Shared reputation.
The economics make sense for the ESP. Maintaining dedicated infrastructure per customer is expensive. Pooling senders onto shared resources keeps costs down and simplifies operations.
The problem is that email reputation is shared too. If another sender on your shared IP sends a spam-adjacent campaign — bought list, aggressive subject lines, no unsubscribe link — the IP's reputation drops. ISPs don't distinguish between senders on the same IP. They see the IP, check its reputation, and make a delivery decision.
Your carefully segmented, double-opted-in, well-crafted email gets spam-foldered because someone else on the same IP did something stupid. You'll never know who. The ESP probably won't tell you. You just see your open rates (the ones that still work) and click rates decline.
Some ESPs mitigate this with subuser isolation, IP rotation, or reputation monitoring. PushMail's managed mode does this — every organization gets its own SendGrid subuser. But even subuser isolation has limits. The underlying IP pool is still shared.
What BYOK actually means
BYOK — Bring Your Own Key — means you use your own SendGrid API key with PushMail. When you send an email through PushMail in BYOK mode, it goes through your SendGrid account. Your IPs. Your domain authentication. Your sending history.
PushMail handles everything else: contact management, list segmentation, template rendering, drip sequences, campaign scheduling, analytics, webhook processing. But the actual email delivery happens through infrastructure you control.
Your SendGrid account is the investment you've already made. You've warmed your IPs. You've authenticated your domains. You've built sending history with ISPs. BYOK lets you keep all of that while adding the features SendGrid doesn't have — sequences, campaigns, per-site isolation, and pay-per-email pricing.
When to use BYOK
You already have a warmed SendGrid account. If you've spent weeks or months warming IPs and building reputation on SendGrid, switching to a new ESP means starting over. BYOK lets you keep your existing reputation and add PushMail's features on top.
You need full reputation control. If your business depends on email deliverability — transactional notifications, time-sensitive alerts, revenue-generating campaigns — you can't afford to share reputation with anyone. BYOK gives you a clean separation.
You're migrating from raw SendGrid API usage. Many developers start by integrating SendGrid directly. They write their own sending logic, template rendering, and queue management. When they outgrow that, they need a platform — but they don't want to abandon the SendGrid account they've invested in. BYOK is the migration path.
You have compliance requirements. Some industries require that email sending infrastructure is under the organization's direct control. BYOK satisfies this — the SendGrid account is yours, under your billing, in your audit trail.
When managed mode is fine
BYOK isn't for everyone. PushMail's managed mode — where we handle the SendGrid infrastructure — works well for:
New senders — If you don't have an existing SendGrid account, there's no reputation to preserve. Start with managed mode and let us handle IP warmup and reputation management.
Low volume senders — Under 10,000 emails per month, the shared infrastructure risk is minimal. The IP pool has enough healthy volume from other senders to maintain good reputation.
Teams that don't want to manage SendGrid — SendGrid's dashboard, settings, authentication records, and billing are another thing to manage. If you'd rather not, managed mode abstracts it away.
PushMail's managed mode uses per-org subuser isolation. Your reputation is tracked separately from other PushMail customers. It's not the same as a fully dedicated account, but it's significantly better than the shared-pool approach most ESPs use.
Setting it up
BYOK configuration takes about two minutes.
Step 1: Create a SendGrid API key. In your SendGrid dashboard, go to Settings > API Keys > Create API Key. Give it "Restricted Access" with only Mail Send permissions enabled. Name it something like "PushMail BYOK."
Step 2: Add it as a sending config in PushMail. Use the API to create a sending configuration with your key:
curl -X POST https://pushmail.dev/api/v1/sending-configs \
-H "Authorization: Bearer pm_live_your_api_key" \
-H "Content-Type: application/json" \
-d '{
"name": "My SendGrid Account",
"provider": "sendgrid",
"apiKey": "SG.your_sendgrid_api_key",
"fromEmail": "hello@yourdomain.com",
"fromName": "Your Company"
}'Step 3: Assign it to a site. Link the sending config to whichever site should use it. All emails sent for that site will go through your SendGrid account.
That's it. PushMail encrypts and stores your API key. All sends for that site route through your SendGrid account. You see delivery events in both PushMail's dashboard and your SendGrid activity feed.
What you keep control of
With BYOK, the following stays entirely under your control:
- IP reputation — Your SendGrid account, your IPs, your reputation history
- Domain authentication — Your SPF, DKIM, and DMARC records, configured in your SendGrid account
- Sending limits — Your SendGrid plan's rate limits and daily caps
- Event history — Full activity logs in both PushMail and SendGrid
- Billing — Your SendGrid invoice is separate from PushMail. You see exactly what email delivery costs you.
The bottom line
If you've invested in building a SendGrid sending reputation, don't throw it away by switching to an ESP that sends from their own infrastructure. BYOK lets you keep the infrastructure you've built and add the platform features you need.
Use managed mode if you're starting fresh. Use BYOK if you have something worth keeping.