itpp-infrastructure/projects/resend-transactional-email.md

Resend — Transactional Email Platform (Future Project)

Status: PLACEHOLDER — not_started Prepared for: Germaine Brown / IT Pro Partner Date: August 14, 2026 Trigger: Projects that email END USERS (confirmations, receipts, notifications) need per-domain From: with SPF/DKIM. The shared relay (SiteGround / MXroute) can only send as its own hosted domains — it can't send "as" arbitrary client domains.

---

Why this exists (and what it is NOT)

Two distinct email needs, don't conflate them:

Need	Recipient	Correct pattern	Status
Contact-form notification	Site owner	One trusted sender + per-domain routing + Reply-To	✅ MSP Form Handler already does this
End-user email (confirm/receipt)	The submitter / customer	Per-domain From with SPF/DKIM	❌ Needs Resend

The MSP Form Handler (forms.itpropartner.com) notifies site owners only — noreply@itpropartner.com, per-domain recipient mapping in config/domains.yaml, Reply-To = submitter. That is the correct architecture and does not change.

But some projects email end users directly — WordPress contact-form auto-replies, appointment confirmations, receipts, welcome emails. Those should come from the client's own domain (hello@client.com) so they pass SPF/DKIM and avoid spam. The shared relay can't do that. Resend can.

Which projects need it

• Current WordPress sites that send confirmation/auto-reply email to end users (enumerate at activation).
• Future projects with receipts / confirmations / notifications.
• MSP Form Handler — only if/when it gains submitter auto-acknowledgements.

What Resend gives us

• Per-domain verification: add SPF + DKIM (optional DMARC) to each client domain, then send "as" that domain.
• One account, many domains, domain-scoped API keys.
• Dedicated IP reputation + bounce/complaint tracking — better deliverability than a shared-hosting relay.
• SMTP + REST API. WordPress via WP Mail SMTP / FluentSMTP or a lightweight Resend plugin; custom apps via the REST API.

Cost (verify current pricing at activation)

• Free: ~3,000 emails/mo, 100/day, single domain.
• Pro: ~$20/mo — ~50k/mo, unlimited domains, dedicated IP add-on.
• For multi-client domain needs, Pro (unlimited domains) is the likely tier.

Architecture (planned)

• One Resend account under g@germainebrown.com.
• Per client needing it: verify their domain (SPF + DKIM in their DNS — we control most via Cloudflare), create a domain-scoped API key.
• WordPress: WP Mail SMTP pointed at Resend with the client's domain as sender.
• Custom apps (FastAPI / Node): Resend REST API, per-domain sender.
• API keys live in Vaultwarden — never in plaintext or committed config.

Activation checklist

• Create Resend account.
• Decide Free vs Pro (Pro for unlimited domains).
• Verify first client domain (SPF + DKIM records).
• Wire first project (WordPress plugin or API).
• Set DMARC on sending domains (p=none → quarantine as volume grows).
• Store API key in Vaultwarden.
• Add to backup/DR inventory if it becomes critical path.

Decision points (open)

• Resend vs AWS SES vs Postmark (Resend = default pick; simplest DX, cheap).
• Single account with per-domain keys vs per-client accounts.
• Sending subdomain convention: mail.client.com (recommended) vs apex client.com — subdomain keeps SPF/DKIM/DMARC clean and isolated.

Related

• smtp-relay-configuration skill — netcup outbound only allows 2525; shared relay rejects non-hosted MAIL FROM.
• MSP Form Handler lives at /var/www/msp-forms on app3 (FastAPI, config/domains.yaml, config/settings.yaml).