Production checklist

Work through this list before you go live.

Domain#

• Your sending subdomain shows Verified, with DKIM, SPF, and bounce MX records verified.
• A DMARC record is published for the subdomain.
• You sent a test email and it reached the inbox, not spam.
• Production and staging send from different subdomains, such as mail.example.com and mail.staging.example.com.

API keys#

• Production uses its own API key, separate from development and staging.
• Application servers use Email send only keys, restricted to their sending domain.
• Keys are stored in a secret manager or environment variables — never in code, logs, or the browser.
• You know how to rotate a key quickly.

Sending#

• Every send uses an idempotency key derived from the triggering event.
• Transient failures are retried with backoff; validation and permission errors are logged and alerted on.
• Emails are sent from background jobs, not inside user-facing requests.
• Messages include a plain-text version and a replyTo address that someone reads.

Monitoring#

• A webhook receives at least email.bounced, email.complained, and email.failed.
• The webhook receiver verifies signatures and stores events before acknowledging them.
• Someone is alerted when bounce or complaint rates rise. See Deliverability.
• You log each request's correlationId from error responses, for faster support.

Limits#

• You've reviewed your plan's sending, domain, and contact allowances in Usage limits.
• Your code distinguishes rate limits (retry after Retry-After) from plan limits (no retry).