Email 2/7 (Ops 0): Resend teams, domains, records and staging credentials #420

Part of #418. Read the parent first. Step 2 of 7. No code.

Goal

Create the Resend teams, domains, records and staging credentials. #421 (PR 2) and #422 (PR 3) need them for their staging checks.

Owner and gate

• Owner: maintainer. It needs the Resend account and DNS access.
• Gate: D1 (region), D2 (teams and domains) and D6 (plan) are ruled on Tracking: move email to Resend behind a pluggable provider #418. D1 and D2 are fixed once a domain exists.

Steps

0. Records. Download Resend's signed DPA and file it with the operator's records. Check Resend's entry on dataprivacyframework.gov, including the UK Extension. Save the sub-processor list with today's date, and subscribe to its change notices. Add a Resend row to the record of processing: email address, name and mail content; purpose sign-in and notification mail; retention 30 days (unverified).

1. Create each D2 team, on the D6 plan. Turn on two-factor sign-in, and keep members to the maintainer plus one backup. Create each team's domain in the D1 region.

2. For each domain, add the DNS records Resend shows: DKIM (resend._domainkey), plus SPF TXT and MX on its send. subdomain.

3. Add DMARC for each domain, starting at p=none with a rua report address. Skip this if the parent domain already has a DMARC record that covers it.

4. Turn open and click tracking off on every domain. Click tracking rewrites signed unsubscribe links and magic links.

5. Wait until every domain shows Verified.

6. Create two send-only API keys:

   • staging, in the staging team, limited to its domain;
   • auth-smtp, in the auth team, limited to its domain, for Email 7/7 (Ops B): Supabase Auth magic links through Resend SMTP #425 (Ops B).

   The prod product key is created in Email 6/7 (Ops A): production product mail cutover to Resend #424 (Ops A).

7. Create a staging webhook endpoint for https://<staging rest-api host>/api/email/webhooks/resend, with events email.bounced, email.complained, email.suppressed and email.failed. Copy its whsec_ secret.

   • The route arrives in Email 4/7 (PR 3): Resend webhook for bounces and complaints #422 (PR 3). Until then, Resend gets 404 and retries. You can also add the endpoint after Email 4/7 (PR 3): Resend webhook for bounces and complaints #422 reaches staging.

8. Put these in /opt/projects/stage.docs.plus/.env only. Do not change EMAIL_PROVIDER yet:

   RESEND_API_KEY=<staging key>
   RESEND_WEBHOOK_SECRET=<staging whsec_>
   

9. Prove that the auth key works over SMTP. This is the one fact we could not confirm from docs. From your own machine, run swaks --server smtp.resend.com:465 --tls-on-connect --auth-user resend --from no-reply@auth.docs.plus --to <your address>, and type the auth-smtp key at the password prompt. Never use a web-based SMTP tester; it would see the key. If it is refused, post the error here; Email 7/7 (Ops B): Supabase Auth magic links through Resend SMTP #425 (Ops B) then needs a full-access key or another plan. If the key was ever pasted anywhere else, rotate it.

Acceptance

• The DPA is filed, the DPF entry is checked, and the record of processing has a Resend row.
• Each team has two-factor sign-in and at most two members.
• Every domain shows Verified, in the D1 region.
• Tracking is off on every domain.
• The staging host env file holds the staging key and webhook secret.
• One test mail was sent with the auth-smtp key over SMTP.

Exit evidence

Post as a comment here:

• "DPA filed, DPF checked, records updated" with the date. Do not paste the documents.
• The team member list per team.
• A screenshot of each team's domains page showing region, Verified and tracking.
• The SMTP test result: the message id, or the error.
• Never paste a key or a secret.

Revert

Delete the teams, domains and keys in Resend, and remove the two lines from the staging host env file.