# Resend — Transactional Email Platform (Future Project)

**Status:** PLACEHOLDER — not_started
**Prepared for:** Germaine Brown / IT Pro Partner
**Date:** August 14, 2026
**Trigger:** Projects that email END USERS (confirmations, receipts, notifications) need per-domain `From:` with SPF/DKIM. The shared relay (SiteGround / MXroute) can only send as its own hosted domains — it can't send "as" arbitrary client domains.

---

## Why this exists (and what it is NOT)

Two distinct email needs, don't conflate them:

| Need | Recipient | Correct pattern | Status |
|---|---|---|---|
| Contact-form notification | Site owner | One trusted sender + per-domain routing + Reply-To | ✅ MSP Form Handler already does this |
| End-user email (confirm/receipt) | The submitter / customer | **Per-domain `From`** with SPF/DKIM | ❌ Needs Resend |

The MSP Form Handler (`forms.itpropartner.com`) notifies **site owners** only — `noreply@itpropartner.com`, per-domain recipient mapping in `config/domains.yaml`, Reply-To = submitter. That is the correct architecture and does not change.

But some projects email **end users** directly — WordPress contact-form auto-replies, appointment confirmations, receipts, welcome emails. Those should come **from the client's own domain** (`hello@client.com`) so they pass SPF/DKIM and avoid spam. The shared relay can't do that. **Resend can.**

## Which projects need it

- Current WordPress sites that send confirmation/auto-reply email to end users (enumerate at activation).
- Future projects with receipts / confirmations / notifications.
- MSP Form Handler — only if/when it gains submitter auto-acknowledgements.

## What Resend gives us

- **Per-domain verification:** add SPF + DKIM (optional DMARC) to each client domain, then send "as" that domain.
- **One account, many domains**, domain-scoped API keys.
- Dedicated IP reputation + bounce/complaint tracking — better deliverability than a shared-hosting relay.
- **SMTP + REST API.** WordPress via WP Mail SMTP / FluentSMTP or a lightweight Resend plugin; custom apps via the REST API.

## Cost (verify current pricing at activation)

- Free: ~3,000 emails/mo, 100/day, single domain.
- Pro: ~$20/mo — ~50k/mo, unlimited domains, dedicated IP add-on.
- For multi-client domain needs, Pro (unlimited domains) is the likely tier.

## Architecture (planned)

- One Resend account under `g@germainebrown.com`.
- Per client needing it: verify their domain (SPF + DKIM in their DNS — we control most via Cloudflare), create a domain-scoped API key.
- WordPress: WP Mail SMTP pointed at Resend with the client's domain as sender.
- Custom apps (FastAPI / Node): Resend REST API, per-domain sender.
- API keys live in Vaultwarden — never in plaintext or committed config.

## Activation checklist

- [ ] Create Resend account.
- [ ] Decide Free vs Pro (Pro for unlimited domains).
- [ ] Verify first client domain (SPF + DKIM records).
- [ ] Wire first project (WordPress plugin or API).
- [ ] Set DMARC on sending domains (`p=none` → `quarantine` as volume grows).
- [ ] Store API key in Vaultwarden.
- [ ] Add to backup/DR inventory if it becomes critical path.

## Decision points (open)

- Resend vs AWS SES vs Postmark (Resend = default pick; simplest DX, cheap).
- Single account with per-domain keys vs per-client accounts.
- Sending subdomain convention: `mail.client.com` (recommended) vs apex `client.com` — subdomain keeps SPF/DKIM/DMARC clean and isolated.

## Related

- `smtp-relay-configuration` skill — netcup outbound only allows 2525; shared relay rejects non-hosted MAIL FROM.
- MSP Form Handler lives at `/var/www/msp-forms` on app3 (FastAPI, `config/domains.yaml`, `config/settings.yaml`).