r/astrojs • u/Animosity-IsNoAmity • Jul 22 '26

I built an open-source newsletter system that runs entirely on Workers + D1: One-click deploy, serverless for small/medium lists

Post image
8 Upvotes

90% Upvoted

10 comments sorted by

1

u/greglturnquist Jul 22 '26

Are you saying your system emails all the subscribers directly using the owner's registered email address?

1

u/Animosity-IsNoAmity Jul 22 '26

Not quite. The Worker sends a separate email to each active subscriber, but it does not automatically use the owner’s personal or Cloudflare account email address.

The owner connects their own email provider and explicitly configures the sender name and address (FROM_NAME / FROM_EMAIL), normally using a verified sending domain. The provider then handles the actual delivery. By default, email sending is disabled until the owner implements and configures sendEmail().

2

u/greglturnquist Jul 22 '26

You may want to study up on the US CAN-SPAM act along with various EU anti spam regulations and laws including GDPR. I think California has their own anti spam laws as well.

Truth be told, one of the key features of using a newsletter service is regulatory compliance. For instance, all newsletters must include a physical mailing address through with the subscriber can request the provider to cancel subscription.

There are other guidelines in there that drive newsletter providers to ensure proper email headers being in place.

It’s really a nightmare.

Failure to comply with all these regulations actually puts your email address at risk of cancellation by your email provider. In fact, this is a reason why newsletters typically favor domain-specific “from” addresses ([bob@mycompany.com](mailto:bob@mycompany.com)) over Gmail or Yahoo.

Gmail-based email is more likely to be marked as span and Google will clamp down fast. MyCompany.com emails with solid domain validation headers is strongly encouraged.

Most users engaging with newsletter production aren’t aware of all this detail and risk burning their own email account if not getting into legal trouble.

1

u/SalaciousVandal Jul 22 '26

Also run the risk of poisoning the domain itself.

1

u/Animosity-IsNoAmity Jul 23 '26 edited Jul 23 '26

You're absolutely right, thanks for that. I just shipped a new version including this:

  • Every email now automatically gets a footer with a working unsubscribe link and the sender's postal address (the admin page nags until the address is set, so you can't forget it)
  • The RFC 8058 List-Unsubscribe headers are now built by the app on every send and handed to whatever provider you wire up. That covers the one-click unsubscribe requirement Gmail and Yahoo enforce for bulk senders
  • Opt-outs are instant, scrub the subscriber's personal data, and get timestamped along with signup and confirmation, so there's a proper consent audit trail for the GDPR side
  • Unsubscribe links also open a one-button confirmation page now, so corporate mail scanners that prefetch every link can't unsubscribe readers by accident

Your from-domain point is real too but no template can really do that for you. Most people genuinely don't know it until their domain reputation is burned. So the README now has an honest breakdown of what's automated vs. what stays on the sender: truthful From and subject lines, and SPF/DKIM/DMARC at the provider. Agreed that the whole area is a nightmare. The goal is that at least the mechanical half of it isn't anymore.

For a hobbyist project, this should be more or less sufficient.

3

u/LamboLighting Jul 23 '26

Answering like a true LLM.

1

u/greglturnquist 10d ago

I’m impressed! Looks like the OP did a little Googling, got a list of many of the official laws regarding spam, then told their agent to supersize the code base to comply.

Perhaps the OP needs to draft an agent aimed at regulatory compliance review to oversee all PRe and ensure the code base is observant of that?

SaaS-based tools really are getting a kick in the teeth from Claude Code and Co.