0035 — Resend for email, with SPF, DKIM and DMARC

Context

Products send transactional email (sign-in links, receipts). Deliverability depends on authenticated sending domains.

Resend is the email provider, behind the @stackra/notifications email channel driver, so it can be swapped.
Every sending domain publishes SPF, DKIM and DMARC records before it is used in an environment.
The API key is a secret held in Infisical, by name only (0009).
DMARC policy progression (none, then quarantine, then reject): TODO.

One vendor and one driver to operate; DNS records are part of environment setup.

Planned — a runway check that the DNS records for a deploy target’s sending domain exist and validate.

Supersedes: none. Sources: owner decisions in chat, 2026-10-19.