Mailjet currently has no mechanism for account admins to enforce multi-factor authentication (MFA) across all users and sub-users in their organization. In 2026, this is a critical security gap for any mission-critical email service provider.

Current Behavior

MFA is optional and user-controlled – it cannot be mandated by the account admin.
Users who create a free Mailjet account first and are subsequently added as a sub-user to an organization inherit their personal account's authentication posture. The organization admin has zero control over their MFA status.
There is no support for phishing-resistant authentication methods (e.g., passkeys / FIDO2).

Problem Statement

Email delivery infrastructure is high-impact by design. A single compromised Mailjet account can be weaponized to send fraudulent emails to tens of thousands of recipients within minutes. The downstream consequences include:

Mass phishing or malware distribution
Severe reputational damage and domain blacklisting
Regulatory exposure (GDPR, etc.) for data controllers using the platform
Loss of customer trust that can be permanent

For any organization operating at scale or under compliance obligations, the inability to enforce authentication standards across all users is a vendor disqualifier in 2026. Post-2022, NIST SP 800-63B and industry best practice treat admin-enforceable MFA as a baseline, not a premium feature.

The free-account-first onboarding path compounds the issue: it effectively delegates security policy to individual end users, which is architecturally unsound.

Requested Features

1. Admin-Enforced MFA Policy

Allow account admins to require MFA for all sub-users before they can access any sending functionality.
Block login and API key generation for non-compliant users until MFA is enrolled.
Provide a compliance dashboard showing MFA status per user.

1. Passkey / FIDO2 Support (Phishing-Resistant)

Implement WebAuthn/FIDO2 as a primary authentication option.
Passkeys eliminate credential phishing entirely – the gold standard for accounts with mass-send capability.

1. Enforce MFA Regardless of Account Origin

If a user registered a free account prior to being added to an organization, the organization's MFA policy must still apply when accessing the organization context.
Authentication posture must be scoped to the session context, not just the primary account.

1. API Key Scoping and MFA Gate

Require MFA re-verification before generating or rotating API keys.
Allow admins to set expiry policies on API keys per sub-user.

Security Impact Assessment

RiskLikelihood without fixImpactSub-user credential compromiseHighMass spam / phishing sendRegulatory breach (GDPR Art. 32)MediumFines, contractual liabilityDomain blacklistingHighBusiness continuity disruptionCISO-level vendor rejectionCertainCustomer churn

References

NIST SP 800-63B – Digital Identity Guidelines (MFA requirements)
FIDO Alliance – Passkey adoption standards
CISA – Known Exploited Vulnerabilities: credential-based account takeovers
Google / Microsoft passkey rollouts as industry precedent

Closing Note

A hijacked transactional email account is not a low-severity incident. It is a direct vector for large-scale harm to end users who never consented to be targets. Mailjet's current authentication model places an unacceptable amount of trust in individual user behavior, with no organizational override. This must be fixed urgently to remain a credible enterprise vendor.