root
f5175f1ce0
- audit/phase-one + phase-two: security audit briefs, findings, credential-rotation plan, Docker-USER hardening scripts, rollback refs - disaster-recovery/restore-test-log.md + backup-dr-audit-2026-08-10.md - clients/ (modelortho SEO audit, ai-biz-dev competitive landscape), notes/ (tiktok strategy) - projects/: front-desk-voice-agent, seo-visibility-checker product plan, hotnow-savannah HTML, resend-transactional-email, backup-dashboard-enhancements, code-review-graph, seo-ci-architecture - proposals/verdicttank/: architecture v4.0, methodology, judge-pool review, consolidation reasoning, cross-check review - docs/super-search/firecrawl-provider-strategy.md - updates: CHANGELOG, model-chain, projects-master-readme, intelsight.io - .gitignore: exclude nested standalone repos (seo-tool, venturebuilt)
70 lines
3.6 KiB
Markdown
70 lines
3.6 KiB
Markdown
# Resend — Transactional Email Platform (Future Project)
|
|
|
|
**Status:** PLACEHOLDER — not_started
|
|
**Prepared for:** Germaine Brown / IT Pro Partner
|
|
**Date:** August 14, 2026
|
|
**Trigger:** Projects that email END USERS (confirmations, receipts, notifications) need per-domain `From:` with SPF/DKIM. The shared relay (SiteGround / MXroute) can only send as its own hosted domains — it can't send "as" arbitrary client domains.
|
|
|
|
---
|
|
|
|
## Why this exists (and what it is NOT)
|
|
|
|
Two distinct email needs, don't conflate them:
|
|
|
|
| Need | Recipient | Correct pattern | Status |
|
|
|---|---|---|---|
|
|
| Contact-form notification | Site owner | One trusted sender + per-domain routing + Reply-To | ✅ MSP Form Handler already does this |
|
|
| End-user email (confirm/receipt) | The submitter / customer | **Per-domain `From`** with SPF/DKIM | ❌ Needs Resend |
|
|
|
|
The MSP Form Handler (`forms.itpropartner.com`) notifies **site owners** only — `noreply@itpropartner.com`, per-domain recipient mapping in `config/domains.yaml`, Reply-To = submitter. That is the correct architecture and does not change.
|
|
|
|
But some projects email **end users** directly — WordPress contact-form auto-replies, appointment confirmations, receipts, welcome emails. Those should come **from the client's own domain** (`hello@client.com`) so they pass SPF/DKIM and avoid spam. The shared relay can't do that. **Resend can.**
|
|
|
|
## Which projects need it
|
|
|
|
- Current WordPress sites that send confirmation/auto-reply email to end users (enumerate at activation).
|
|
- Future projects with receipts / confirmations / notifications.
|
|
- MSP Form Handler — only if/when it gains submitter auto-acknowledgements.
|
|
|
|
## What Resend gives us
|
|
|
|
- **Per-domain verification:** add SPF + DKIM (optional DMARC) to each client domain, then send "as" that domain.
|
|
- **One account, many domains**, domain-scoped API keys.
|
|
- Dedicated IP reputation + bounce/complaint tracking — better deliverability than a shared-hosting relay.
|
|
- **SMTP + REST API.** WordPress via WP Mail SMTP / FluentSMTP or a lightweight Resend plugin; custom apps via the REST API.
|
|
|
|
## Cost (verify current pricing at activation)
|
|
|
|
- Free: ~3,000 emails/mo, 100/day, single domain.
|
|
- Pro: ~$20/mo — ~50k/mo, unlimited domains, dedicated IP add-on.
|
|
- For multi-client domain needs, Pro (unlimited domains) is the likely tier.
|
|
|
|
## Architecture (planned)
|
|
|
|
- One Resend account under `g@germainebrown.com`.
|
|
- Per client needing it: verify their domain (SPF + DKIM in their DNS — we control most via Cloudflare), create a domain-scoped API key.
|
|
- WordPress: WP Mail SMTP pointed at Resend with the client's domain as sender.
|
|
- Custom apps (FastAPI / Node): Resend REST API, per-domain sender.
|
|
- API keys live in Vaultwarden — never in plaintext or committed config.
|
|
|
|
## Activation checklist
|
|
|
|
- [ ] Create Resend account.
|
|
- [ ] Decide Free vs Pro (Pro for unlimited domains).
|
|
- [ ] Verify first client domain (SPF + DKIM records).
|
|
- [ ] Wire first project (WordPress plugin or API).
|
|
- [ ] Set DMARC on sending domains (`p=none` → `quarantine` as volume grows).
|
|
- [ ] Store API key in Vaultwarden.
|
|
- [ ] Add to backup/DR inventory if it becomes critical path.
|
|
|
|
## Decision points (open)
|
|
|
|
- Resend vs AWS SES vs Postmark (Resend = default pick; simplest DX, cheap).
|
|
- Single account with per-domain keys vs per-client accounts.
|
|
- Sending subdomain convention: `mail.client.com` (recommended) vs apex `client.com` — subdomain keeps SPF/DKIM/DMARC clean and isolated.
|
|
|
|
## Related
|
|
|
|
- `smtp-relay-configuration` skill — netcup outbound only allows 2525; shared relay rejects non-hosted MAIL FROM.
|
|
- MSP Form Handler lives at `/var/www/msp-forms` on app3 (FastAPI, `config/domains.yaml`, `config/settings.yaml`).
|