Scale transactional email from 10k to 500k/mo: compare Resend ($20/50k) vs Postmark ($55/50k) vs AWS SES ($0.10/1k = $5 for 50k) with Terraform automation.
resource "aws_ses_domain_identity" "main" {
domain = "api.yourcompany.com"
}
resource "aws_ses_domain_dkim" "main" {
domain = aws_ses_domain_identity.main.domain
}
resource "aws_route53_record" "dkim" {
count = 3
zone_id = var.hosted_zone_id
name = "${element(aws_ses_domain_dkim.main.dkim_tokens, count.index)}._domainkey.api.yourcompany.com"
type = "CNAME"
ttl = 300
records = ["${element(aws_ses_domain_dkim.main.dkim_tokens, count.index)}.dkim.amazonses.com"]
}
Building transactional email delivery (verification codes, invoices, security alerts) for a modern software application requires navigating a maze of deliverability standards: SPF, DKIM, DMARC, and BIMI. Historically, startups defaulted to SendGrid or Mailgun, only to face sudden tier upgrades, aggressive account suspensions, and confusing pricing calculators once email volumes expanded past 10,000 messages.
In 2026, the optimal transactional email architecture breaks into two distinct tiers: Amazon SES (Simple Email Service) for rock-bottom wholesale volume pricing, and Resend for superior developer ergonomics and React Email component templates.
| Email Provider Stack | Base Fee | Rate per 10k Emails | Monthly Cost (100k Emails) | Deliverability Management |
|---|---|---|---|---|
| Amazon SES (Direct SMTP) | $0.00 / mo | $1.00 / 10k | $10.00 / mo (Unbeatable) | Self-managed bounce queues & SNS alerts |
| Resend (Pro Tier) | $20.00 / mo (50k incl) | $9.00 / 10k | $65.00 / mo | Managed deliverability + React Email DX |
| Postmark (Transactional) | $15.00 / mo (10k incl) | $11.50 / 10k | $115.00 / mo | Isolated transactional IP pools (Gold Standard) |
| SendGrid (Twilio) | $19.95 / mo (50k incl) | $18.00 / 10k | $89.95 / mo | Shared IP pool prone to spam neighborhood issues |
The primary reason developers abandon raw Amazon SES is fear of account suspension due to high bounce rates (>5%). The industry-standard architecture pairs Amazon SES with AWS SNS and SQS to automatically suppress invalid addresses:
// Next.js Server Action with Resend & React Email
import { Resend } from 'resend';
import { PasswordResetEmail } from '@/emails/password-reset';
const resend = new Resend(process.env.RESEND_API_KEY);
export async function sendResetEmail(userEmail: string, resetToken: string) {
const { data, error } = await resend.emails.send({
from: 'Security ',
to: [userEmail],
subject: 'Reset your security credentials',
react: PasswordResetEmail({ resetLink: `https://app.yourdomain.com/reset?token=${resetToken}` }),
headers: { 'X-Entity-Ref-ID': resetToken }
});
if (error) throw new Error(`Email dispatch failed: ${error.message}`);
return data;
}
Transitioning from developer-friendly APIs like Resend ($20/mo for 50k emails) to infrastructure-native AWS Simple Email Service (SES) reduces per-message delivery costs by up to 90%. However, SES requires teams to engineer their own reputation defenses. Out of the box, SES places new accounts in a restrictive sandbox (200 emails/day, 1 email/sec) and terminates accounts if hard bounce rates exceed 5.0% or complaint rates exceed 0.1% (1 complaint per 1,000 deliveries). Maintaining high inbox placement requires automated SNS event pipelines that intercept bounces before they taint domain sender scores.
| Monthly Volume | AWS SES (Shared IP) | AWS SES (+ Dedicated IP) | Resend (Developer Tier) | Postmark | Self-Hosted (Postal / VPS) |
|---|---|---|---|---|---|
| 25,000 emails | $2.50 | $27.25 | $20.00 | $31.50 | $6.00 (Hetzner VPS) |
| 250,000 emails | $25.00 | $49.75 | $150.00 | $235.00 | $12.00 (VPS + S3 logs) |
| 1,000,000 emails | $100.00 | $124.75 | $450.00 | $750.00 | $28.00 (Redundant VPS) |
import { SQSClient, ReceiveMessageCommand, DeleteMessageCommand } from '@aws-sdk/client-sqs';
import { db } from './db'; // PostgreSQL / Redis client
const sqs = new SQSClient({ region: 'us-east-1' });
export async function processBounceQueue() {
const { Messages } = await sqs.send(new ReceiveMessageCommand({
QueueUrl: process.env.SES_BOUNCE_SQS_URL,
MaxNumberOfMessages: 10,
WaitTimeSeconds: 20
}));
for (const message of Messages || []) {
const payload = JSON.parse(JSON.parse(message.Body!).Message);
const notificationType = payload.eventType || payload.notificationType;
if (notificationType === 'Bounce' && payload.bounce?.bounceType === 'Permanent') {
for (const recipient of payload.bounce.bouncedRecipients) {
await db.suppressionList.upsert({
where: { email: recipient.emailAddress },
update: { reason: 'HARD_BOUNCE', updatedAt: new Date() },
create: { email: recipient.emailAddress, reason: 'HARD_BOUNCE' }
});
}
} else if (notificationType === 'Complaint') {
for (const recipient of payload.complaint.complainedRecipients) {
await db.suppressionList.upsert({
where: { email: recipient.emailAddress },
update: { reason: 'SPAM_COMPLAINT', updatedAt: new Date() },
create: { email: recipient.emailAddress, reason: 'SPAM_COMPLAINT' }
});
}
}
await sqs.send(new DeleteMessageCommand({ QueueUrl: process.env.SES_BOUNCE_SQS_URL, ReceiptHandle: message.ReceiptHandle! }));
}
}
v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; with custom return-path MX records pointing to SES to prevent spoofing and ensure Gmail/Yahoo postmaster compliance.Teams should switch when monthly volume crosses 100,000 emails. Below 100k, Resend's $20-$80 pricing is well worth the pre-built React Email rendering, logs, and zero DevOps overhead. Above 250k emails/month, Resend costs $150-$450 compared to SES at $25-$100, yielding annual savings of over $4,000 that easily justifies building an SQS bounce suppression consumer.
The primary risk is IP reputation contamination. Residential and budget VPS IP blocks (Hetzner, DigitalOcean, OVH) are often pre-blacklisted on Spamhaus and Microsoft SNDS due to past bad actors. Getting removed from Microsoft SNDS or Gmail Spam feedback loops can take weeks of manual delisting tickets, resulting in lost user signups and forgotten password reset emails.