Which email provider sends password resets? #349

New issue

Closed

opened 2026-10-11 12:59:30 +00:00 by root · 5 comments

root commented

2026-10-11 12:59:30 +00:00

(Migrated from gitlab.core-project.space)

Imported from GitHub amaurycoudr/chess-project#349, opened by @amaurycoudr on 2026-10-11 12:59 UTC.
Closed on GitHub on 2026-10-11 13:11 UTC as completed.

Parent

#346

Question

Accounts v1 ships password reset by email. Compare transactional email providers for a small hobby project on our own domain: free tier, deliverability, SPF/DKIM/DMARC setup, Node SDK or SMTP, and how previews avoid sending real mail (sandbox or a local catcher).

> _Imported from GitHub [amaurycoudr/chess-project#349](https://github.com/amaurycoudr/chess-project/issues/349), opened by [@amaurycoudr](https://github.com/amaurycoudr) on 2026-10-11 12:59 UTC._ > _Closed on GitHub on 2026-10-11 13:11 UTC as completed._  --- ## Parent #346 ## Question Accounts v1 ships password reset by email. Compare transactional email providers for a small hobby project on our own domain: free tier, deliverability, SPF/DKIM/DMARC setup, Node SDK or SMTP, and how previews avoid sending real mail (sandbox or a local catcher).

root commented

2026-10-11 12:59:30 +00:00

(Migrated from gitlab.core-project.space)

GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links).

Parent (sub-issue of): #346

> _GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links)._  - Parent (sub-issue of): #346

root commented

2026-10-11 13:03:57 +00:00

(Migrated from gitlab.core-project.space)

Imported from a GitHub comment by @amaurycoudr on 2026-10-11 13:03 UTC.

Findings: https://github.com/amaurycoudr/chess-project/blob/research/email-provider/docs/research/email-provider.md

Every candidate (Resend, Postmark, SES, Brevo, Mailgun, Scaleway TEM) accepts SMTP, so the API can send over SMTP from one env URL and treat the provider as config.
Previews: provider sandboxes either count toward quota, are billed, or don't fence off real addresses; a Mailpit container (SMTP 1025, UI/API 8025) never delivers and lets e2e read the reset link.
Free tiers: Resend 3,000/mo (account data in the US), Scaleway TEM 300/mo then €0.25/1k (France only), Brevo 300/day (EU), Postmark 100/mo (US), Mailgun 100/day with 1-day logs, SES pay-per-use plus a sandbox exit per region.
DNS: provider-generated SPF + DKIM, plus our own _dmarc at p=none; Gmail requires SPF or DKIM, PTR and TLS for all senders.
Recommendation (not a decision): SMTP + Mailpit for previews/dev/e2e; Resend for production, or Scaleway TEM if EU residency matters.

> _Imported from a [GitHub comment](https://github.com/amaurycoudr/chess-project/issues/349#issuecomment-6109314701) by [@amaurycoudr](https://github.com/amaurycoudr) on 2026-10-11 13:03 UTC._  Findings: https://github.com/amaurycoudr/chess-project/blob/research/email-provider/docs/research/email-provider.md - Every candidate (Resend, Postmark, SES, Brevo, Mailgun, Scaleway TEM) accepts SMTP, so the API can send over SMTP from one env URL and treat the provider as config. - Previews: provider sandboxes either count toward quota, are billed, or don't fence off real addresses; a Mailpit container (SMTP 1025, UI/API 8025) never delivers and lets e2e read the reset link. - Free tiers: Resend 3,000/mo (account data in the US), Scaleway TEM 300/mo then €0.25/1k (France only), Brevo 300/day (EU), Postmark 100/mo (US), Mailgun 100/day with 1-day logs, SES pay-per-use plus a sandbox exit per region. - DNS: provider-generated SPF + DKIM, plus our own `_dmarc` at `p=none`; Gmail requires SPF or DKIM, PTR and TLS for all senders. - Recommendation (not a decision): SMTP + Mailpit for previews/dev/e2e; Resend for production, or Scaleway TEM if EU residency matters.

root commented

2026-10-11 13:11:33 +00:00

(Migrated from gitlab.core-project.space)

Imported from a GitHub comment by @amaurycoudr on 2026-10-11 13:11 UTC.

Resolution

Production: Resend, reached over SMTP. The API takes one SMTP URL from its environment, so changing provider later is a secret change, not a code change.
Previews, local dev and e2e: Mailpit, which never delivers; the e2e suite reads the reset link through its API.
Hostinger Business Email was considered (the VPS and domain are at Hostinger) and set aside: a paid mailbox for purely automated mail, when Resend's free tier (3,000/month) covers it. Sending straight from the VPS is ruled out (Hostinger caps it at 5/min, and the IP has no reputation).
Accepted: Resend keeps account data in the US.
Left to the Accounts v1 spec: one Mailpit per preview stack or a shared one, and sending from a subdomain or the apex domain.

Research: docs/research/email-provider.md on research/email-provider

> _Imported from a [GitHub comment](https://github.com/amaurycoudr/chess-project/issues/349#issuecomment-6109378945) by [@amaurycoudr](https://github.com/amaurycoudr) on 2026-10-11 13:11 UTC._  ## Resolution - **Production:** Resend, reached over SMTP. The API takes one SMTP URL from its environment, so changing provider later is a secret change, not a code change. - **Previews, local dev and e2e:** Mailpit, which never delivers; the e2e suite reads the reset link through its API. - Hostinger Business Email was considered (the VPS and domain are at Hostinger) and set aside: a paid mailbox for purely automated mail, when Resend's free tier (3,000/month) covers it. Sending straight from the VPS is ruled out (Hostinger caps it at 5/min, and the IP has no reputation). - Accepted: Resend keeps account data in the US. - Left to the Accounts v1 spec: one Mailpit per preview stack or a shared one, and sending from a subdomain or the apex domain. Research: [docs/research/email-provider.md on research/email-provider](https://github.com/amaurycoudr/chess-project/blob/research/email-provider/docs/research/email-provider.md)

root (Migrated from gitlab.core-project.space) closed this issue

2026-10-11 13:11:34 +00:00

root commented

2026-10-13 08:41:16 +00:00

(Migrated from gitlab.core-project.space)

mentioned in issue #346