Our support team can work with you to confirm this, but it is likely that the IP address this request came from has previously been associated with malicious activity. Here are a few common practices that may be helpful in this case:
Add retry with exponential backoff on any 403 whose response body isn't JSON — that signature identifies an edge block rather than a Postmark API error. (Max 2–4 retries)
Establish a dedicated static egress for all outbound application traffic to ensure a predictable network identity. Moving away from shared dynamic IP allocations isolates your service's reputation and prevents third-party security edge blocks.