Key Takeaways

  • Resend reached 100,000 paying customers out of 3 million total registered accounts while keeping its free developer tier intact.
  • Organized spam gangs target email infrastructure using thousands of automated domains spread across separate registrars and DNS providers.
  • Resend's Trust and Safety team proposed killing the free tier entirely to eliminate abuse overnight, but CEO Zeno Rocha rejected the proposal.
  • Rocha protected the tier because free developer tools, specifically GitHub's free accounts during his early career in Brazil, enabled his entry into tech.
  • Instead of gating signups with friction or payment details, Resend stops abuse downstream through strict daily sending quotas and automated bot filters.

The Easy Fix That Kills the Funnel

When you give developers an API key to send email, you also give that key to organized crime. At Resend, malicious traffic did not stem from occasional hobbyists pushing bad scripts. It came from coordinated operations with serious infrastructure.

“Now, we're talking like full gangs,” Rocha said. “Like they are spam gangs. They have like thousands of domains. I'm not talking 10, 20, 100 domains, thousands of domains with different registrars, different DNS services, and they all try to take advantage.”

The internal pressure to end the threat was real. Resend's Trust and Safety team suggested an obvious moonshot: kill the free tier. Shut off free sending, require a credit card or a paid subscription on day one, and the bad actors vanish in an afternoon.

For an infrastructure startup, that trade looks sensible on paper. Spam monitoring eats engineering bandwidth, damages IP reputation with major mailbox providers, and piles up support tickets. Erasing the free plan solves the abuse crisis instantly. Rocha refused to do it.

Developer Roots Beat Defensive Product Design

Rocha's refusal came down to his own history as a junior engineer in South America. He did not have the cash to buy developer tools when he started coding.

“Starting as a software engineer in Brazil, I didn't have any money for the services that I was using, and thankfully GitHub had a free account,” Rocha said. “So I was able to get started with that. The free tier is something that enables a new generation of people to get into tech in the first place.”

Killing the free tier to duck abuse solves an operational headache by destroying your future distribution. Developers building hobby projects with zero budget eventually become senior engineers with enterprise procurement budgets. If you lock your API behind payment credentials, you block the next generation of builders before they write their first line of code.

“If you're one API key away from doing whatever you want to do, you can do a lot of bad things too if you don't have the right intentions,” Rocha noted. “So we have a big challenge in, okay, we want to make it as easy as possible. Great. How do we deal with those bad actors?”

Enforcing Quotas Instead of Adding Friction

Instead of restricting registration, Resend shifted its defenses to usage limits. The company keeps the signup flow open: create an account, generate an API key, and test an email in minutes. The control happens after the account exists.

Resend relies on strict daily quotas for free accounts alongside automated bot detection. A spam operation managing thousands of domains cannot turn a profit when each account is capped at low message volumes and suspicious sending patterns trigger automated flags. The bad economics drive the spam rings away, while real developers working on side projects never hit the threshold.

That decision created massive top-of-funnel momentum. “Just today, this morning, we crossed 100,000 paying customers,” Rocha said. “So, 3 million users total, 100,000 paying customers. And it's just like if you have the right incentives, the right levers at the right places.” The free tier did not dilute Resend; it supplied the conversion pipeline.

What to Do With This

Review your product's abuse prevention policy this week. Pull your team's last ten fraud incidents and check whether your defense strategy relies on adding signup friction, like requiring a phone number or a credit card for free trials. Replace those upfront gates with strict initial velocity limits and low daily quotas that expand only as accounts prove legitimate usage over time.