The two checkboxes on Mail Settings → API said they turned email sending on and off, but only the walk editor and the Brevo list sync ever looked at them. The email composer, contact-us form, expense and booking notifications, password resets, inbox digests, video meeting invites, member sync notifications and campaign sends all went out regardless. They now do what the page says: every send point on the server checks the flags first and refuses with a clear reason when sending is off, and the composer shows that reason before you try. A new setting under Allow Send Transactional decides whether password reset and admin alert emails still go out while everything else is stopped, and it is on by default so nobody is locked out by accident. Each refused send is recorded and listed on the same tab. On the platform admin site, Environment Management can now suspend and resume email sending for any environment, with an optional reason, and a group's own administrators cannot switch that back on.
Mail Settings → API: the Global Settings toggles, each saying exactly what it stops.
When Allow Send Transactional is unticked, a further option appears beneath it deciding whether password reset and admin alert emails still go out. It is on by default, so nobody is locked out by accident.
Still send password reset and admin alert emails, shown only while transactional sending is off.