`EMAIL_PROVIDER_DECISION.md`

192 lines
# Email Provider Decision — info@nationalpaperhangers.com

**Domain:** nationalpaperhangers.com  
**Required address:** info@nationalpaperhangers.com  
**Roles:** CAN-SPAM "From" header address, studio self-claim verification destination  
**Decision date:** 2026-05-05  

---

## Constraints

- Mac2 is residential — no public inbound MX routing to George agent on :9850.
- Steve already has Google Workspace at designerwallcoverings.com ($7/user/mo is sunk cost there).
- NPH is one of many sister sites; per-domain Workspace charges compound fast.
- DMARC aggregate reports (`rua=`) route to `info@designerwallcoverings.com` (Steve already monitors that inbox).
- DKIM signing is non-negotiable for CAN-SPAM/deliverability; unauthenticated forwarding alone is not sufficient.

---

## Option Analysis

### A. Google Workspace — $7/user/month ($84/year)

| Dimension | Assessment |
|---|---|
| Cost | $84/yr per domain, forever |
| Setup complexity | Low — UI-driven, MX records are standard |
| Deliverability | Gold standard; Gmail infrastructure |
| Scales to N domains | No — cost multiplies linearly with domain count |
| Time to first send | ~1 business day (MX propagation + DNS verify) |
| George (Mac2) fit | Native — George bridges GW via Gmail OAuth/app-password |
| DKIM | Provisioned automatically from Admin console |

**Verdict:** Best deliverability and lowest friction, but becomes the most expensive option as the portfolio grows. At 10 sister sites this is $840/yr just for mailboxes.

---

### B. Migadu — Mini plan $90/year (unlimited domains, ~100 outbound/day)

| Dimension | Assessment |
|---|---|
| Cost | $90/yr flat regardless of domain count |
| Setup complexity | Medium — DKIM uses 3 CNAME delegates; webmail provisioning is manual but one-time |
| Deliverability | Good; Migadu IPs are clean, DKIM+DMARC fully supported |
| Scales to N domains | Yes — all sister sites fold into one $90/yr account |
| Time to first send | ~24h (DNS + domain verification TXT + DKIM CNAMEs) |
| George (Mac2) fit | Partial — George sends via SMTP; Migadu Mini outbound cap is 100/day, fine for transactional |
| DKIM | Full 3-key CNAME delegation; verified per domain |

**Verdict:** Best value once Steve has 2+ sister domains needing mailboxes. NPH alone already breaks even vs. Workspace in year 2 (Migadu Mini at $90/yr vs $84/yr for Workspace). With 5 domains on one Migadu account the savings are ~$330/yr vs Workspace.

---

### C. Fastmail — Business Standard $5/user/month ($60/year)

| Dimension | Assessment |
|---|---|
| Cost | $60/yr (annual); custom domains require Standard tier |
| Setup complexity | Low — clean admin UI, standard MX pair |
| Deliverability | Excellent; established provider, good IP reputation |
| Scales to N domains | No — per-user billing; additional custom domains cost extra |
| Time to first send | ~1 business day |
| George (Mac2) fit | Moderate — SMTP credentials work but George was built around Gmail OAuth flow |
| DKIM | Supported; configured from dashboard |

**Verdict:** Cheaper than Workspace per domain but doesn't solve the scaling problem. Not compelling vs Migadu once you account for more than one domain.

---

### D. ImprovMX — Free tier forwarding (receive-only; send via "Send mail as" workaround)

| Dimension | Assessment |
|---|---|
| Cost | $0 free / $9/mo Premium for SMTP+DKIM |
| Setup complexity | Low (receive); Medium (send-as workaround is fragile) |
| Deliverability | **Critical gap:** free tier "Send mail as" bypasses DKIM; Yahoo/strict-DMARC receivers reject or spam-folder. Premium at $9/mo adds DKIM but costs $108/yr — more than Workspace |
| Scales to N domains | Light plan ($50/yr, 5 domains) is plausible but SMTP cap is 25/day |
| Time to first send | Fast for receive; send-as setup adds 30 min |
| George (Mac2) fit | Poor — George sends via SMTP; free tier has no outbound SMTP at all |
| DKIM | **Free: none. Premium: yes.** |

**Verdict:** The free tier fails the CAN-SPAM "from" requirement because unauthenticated forwarded-send fails DMARC alignment on strict receivers. Premium at $108/yr is worse than Workspace. Eliminated.

---

### E. Self-hosted Postfix/Dovecot on Kamatera + OpenDKIM — $0 incremental

| Dimension | Assessment |
|---|---|
| Cost | $0 marginal (Kamatera already running); one-time setup ~4h |
| Setup complexity | High — Postfix + Dovecot + OpenDKIM + SPF milter + DMARC reporting; ongoing ops |
| Deliverability | **High risk:** Kamatera is a cloud VPS; IP `45.61.58.125` is shared with production web traffic. New-sender reputation on VPS IPs is poor out of the box; warming required. No established ESP relationship for FBL/bounces |
| Scales to N domains | Yes — each domain adds one DKIM key + DNS records |
| Time to first send | 1–2 days setup + 2–4 weeks warm-up before bulk is safe |
| George (Mac2) fit | Works — George would SMTP-relay through Kamatera MX |
| DKIM | Fully controllable |

**Verdict:** Viable long-term but Kamatera IP reputation risk is real for a new sender. The ops surface (bounce handling, blacklist monitoring, DMARC aggregate parsing) is non-trivial to maintain. Wrong tool for a mailbox that primarily sends verification emails at low volume.

---

## Recommendation: Migadu Mini — $90/year

**Rationale:**

1. **Flat pricing solves the fleet problem.** One Migadu account covers NPH plus every other sister site Steve adds. The $90/yr Mini plan supports unlimited domains and gives 100 outbound emails/day — sufficient for transactional verification mail and CAN-SPAM-compliant "from" headers at NPH's expected volume.

2. **Full DKIM + DMARC.** Migadu provisions three DKIM CNAME delegates per domain. With DMARC `p=quarantine` after the 14-day monitoring window, deliverability is solid and CAN-SPAM-compliant.

3. **Better economics than Workspace at scale.** At 2 domains, Migadu ($90/yr) already beats 2 × Workspace ($168/yr). Steve's portfolio makes this math increasingly favorable.

4. **George compatibility.** George sends via SMTP. Migadu exposes standard SMTP on port 587 with TLS. George's `SMTP_HOST` / `SMTP_USER` / `SMTP_PASS` env vars just need to point at Migadu instead of Gmail's SMTP relay. No architecture change required.

5. **Inbound routing works.** MX records point inbound mail to Migadu's servers (publicly routable). Replies to claim-verification emails land in the Migadu webmail or can be forwarded to Steve's existing DW inbox — solving the Mac2-not-publicly-routable problem cleanly.

**Total annual cost:** $90/yr (covers all current and future sister domains on one account). Zero marginal cost per additional domain.

---

## DNS Records — Migadu Mini

These records are ready to paste into Cloudflare once the zone is created. Replace `<DKIM-VERIFY-TOKEN>` with the value Migadu shows in its domain-verification step.

### MX Records

| Type | Name | Value | Priority | TTL |
|---|---|---|---|---|
| MX | `@` | `aspmx1.migadu.com.` | 10 | 3600 |
| MX | `@` | `aspmx2.migadu.com.` | 20 | 3600 |

### SPF Record

| Type | Name | Value | TTL |
|---|---|---|---|
| TXT | `@` | `v=spf1 include:spf.migadu.com -all` | 3600 |

Note: `-all` (hard fail) is correct for Migadu. Do not use `~all` (softfail) once DKIM is confirmed working.

### DKIM Records (3 CNAME delegates — Migadu's pattern)

| Type | Name | Value | TTL |
|---|---|---|---|
| CNAME | `key1._domainkey` | `key1.nationalpaperhangers.com._domainkey.migadu.com.` | 3600 |
| CNAME | `key2._domainkey` | `key2.nationalpaperhangers.com._domainkey.migadu.com.` | 3600 |
| CNAME | `key3._domainkey` | `key3.nationalpaperhangers.com._domainkey.migadu.com.` | 3600 |

### Domain Verification TXT (required by Migadu to claim the domain)

| Type | Name | Value | TTL |
|---|---|---|---|
| TXT | `@` | `hosted-email-verify=<DKIM-VERIFY-TOKEN>` | 3600 |

Migadu shows this token in the domain setup wizard. It is domain-specific and generated on first claim.

### DMARC Roll-out

**Phase 1 — Days 1–14 (monitor only):**

| Type | Name | Value | TTL |
|---|---|---|---|
| TXT | `_dmarc` | `v=DMARC1; p=none; rua=mailto:info@designerwallcoverings.com; ruf=mailto:info@designerwallcoverings.com; fo=1; adkim=r; aspf=r` | 3600 |

**Phase 2 — Day 15+ (after reviewing aggregate reports):**

Update `p=none` to `p=quarantine`. After another 14-day clean run, escalate to `p=reject` if desired.

```
v=DMARC1; p=quarantine; rua=mailto:info@designerwallcoverings.com; ruf=mailto:info@designerwallcoverings.com; fo=1; adkim=r; aspf=r
```

The `rua=` and `ruf=` addresses must accept reports from external domains. Migadu domains automatically satisfy this. Google Workspace (DW's host) accepts inbound DMARC reports by default.

---

## Post-Provision George Config Update

Once Migadu SMTP credentials are in hand, update George on Mac2:

```
SMTP_HOST=smtp.migadu.com
SMTP_PORT=587
SMTP_USER=info@nationalpaperhangers.com
SMTP_PASS=<migadu-app-password>
SMTP_FROM=info@nationalpaperhangers.com
```

Route through secrets-manager: `node ~/Projects/secrets-manager/cli.js add MIGADU_SMTP_PASS_NPH <value>` then add `national-paper-hangers` to routes.json for this key.

---

*Sources consulted: Migadu pricing page (migadu.com/pricing, May 2026), ImprovMX pricing page (improvmx.com/pricing, May 2026), Fastmail pricing (fastmail.com/pricing/us, May 2026), ImprovMX Cloudflare guide (improvmx.com/guides/cloudflare), Migadu DNSControl gist (github.com/tennox), MXToolbox Migadu DKIM report.*