The Problem: Email Infrastructure Is Expensive

As a solopreneur building multiple SaaS products, I needed reliable transactional email. The options weren't great:

1. Resend: Beautiful API and DX, but $20/month for 50K emails—adds up fast across multiple products
2. SendGrid: Enterprise pricing, complex configuration, overkill for transactional use cases
3. Postmark: Excellent deliverability but expensive per-email pricing
4. Amazon SES Direct: Dirt cheap ($0.10/1K emails) but raw API, no dashboard, manual DKIM/DMARC setup

I wanted Resend's beautiful API with SES pricing. So I built it.

FreeResend: self-hosted email infrastructure with a 100% Resend-compatible API, running on your own AWS account.

The Vision: Drop-In Resend Replacement

The core principle was simple: change one environment variable, keep everything else the same. If you're using the Resend SDK, switching to FreeResend should be as easy as:

# Before (Resend)
RESEND_API_KEY=re_xxxxx

# After (FreeResend)
RESEND_BASE_URL=https://your-freeresend.com/api
RESEND_API_KEY=frs_xxxxx  # Your FreeResend API key

The Tech Stack: Simple and Production-Ready

The Architecture: Resend API Contract

The key architectural decision: match Resend's API exactly. This means existing codebases using the Resend SDK work without modification.

API Endpoint Structure

Email Sending Flow

When an email is sent through FreeResend:

1. API Key Validation: Extract key from Authorization: Bearer header, verify against hashed keys in database
2. Domain Check: Ensure sender domain is verified and associated with the API key
3. Payload Validation: Zod schema validates request body matches Resend's expected format
4. SES Send: Call AWS SES SendEmail or SendRawEmail based on content type
5. Log Creation: Store email metadata in email_logs table with SES message ID
6. Response: Return Resend-compatible response with { id: messageId }

// Resend SDK works unchanged
import { Resend } from 'resend';

const resend = new Resend('frs_your_api_key');

const { data, error } = await resend.emails.send({
  from: 'onboarding@yourdomain.com',
  to: ['user@example.com'],
  subject: 'Hello World',
  html: '<strong>It works!</strong>'
});

Domain Verification: The Hard Part Made Easy

Email deliverability depends on proper DNS configuration. Most developers dread setting up DKIM, SPF, and DMARC. FreeResend automates all of it.

What Gets Created

When you add a domain, FreeResend:

• TXT Record: _amazonses.yourdomain.com for SES domain verification
• 3 CNAME Records: *._domainkey.yourdomain.com for DKIM signatures
• MX Record: For receiving bounce notifications via SES
• SPF Record: Declares SES as authorized sender
• DMARC Record: Policy for handling authentication failures

Automatic DNS with DigitalOcean

If you provide a DigitalOcean API token, FreeResend creates all DNS records automatically:

// lib/digitalocean.ts
async function createDNSRecords(domain: string, records: DNSRecord[]) {
  for (const record of records) {
    await fetch(`https://api.digitalocean.com/v2/domains/${domain}/records`, {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${process.env.DO_API_TOKEN}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        type: record.type,
        name: record.name,
        data: record.value,
        ttl: 1800
      })
    });
  }
}

For other DNS providers, the dashboard displays all required records with copy buttons. Manual setup takes 5 minutes.

API Key Security: Never Store Plain Text

API keys are sensitive. A database leak shouldn't expose them. FreeResend uses a secure key generation pattern:

Key Structure

// Format: frs_{keyId}_{secretPart}
// Example: frs_abc123_xYz789defGHI...

const keyId = nanoid(6);        // Public identifier
const secretPart = nanoid(32);  // Secret portion
const fullKey = `frs_${keyId}_${secretPart}`;

// Only store the hash
const keyHash = await bcrypt.hash(secretPart, 10);

await db.query(
  'INSERT INTO api_keys (id, key_hash, domain_id) VALUES ($1, $2, $3)',
  [keyId, keyHash, domainId]
);

// Return full key ONCE - never stored in plain text
return { apiKey: fullKey };

Validation Flow

When validating an API key:

1. Parse the key: extract keyId and secretPart
2. Look up record by keyId (fast index lookup)
3. Compare secretPart against stored hash with bcrypt
4. Return associated domain if valid

This pattern means: even if an attacker gets database access, they can't use the API keys. They'd need to crack bcrypt hashes first.

SES Webhooks: Real-Time Delivery Tracking

SES provides delivery notifications via SNS (Simple Notification Service). FreeResend captures these for email tracking:

• Delivery: Email accepted by recipient's mail server
• Bounce: Hard bounce (invalid email) or soft bounce (mailbox full)
• Complaint: Recipient marked email as spam
• Open: Email opened (if tracking pixel enabled)
• Click: Link clicked (if link tracking enabled)

// /api/webhooks/ses/route.ts
export async function POST(request: Request) {
  const body = await request.json();
  
  // Handle SNS subscription confirmation
  if (body.Type === 'SubscriptionConfirmation') {
    await fetch(body.SubscribeURL);
    return NextResponse.json({ status: 'confirmed' });
  }
  
  // Parse notification
  const message = JSON.parse(body.Message);
  const { notificationType, mail } = message;
  
  // Update email log status
  await db.query(
    'UPDATE email_logs SET status = $1, updated_at = NOW() WHERE ses_message_id = $2',
    [notificationType.toLowerCase(), mail.messageId]
  );
  
  // Store webhook event for debugging
  await db.query(
    'INSERT INTO webhook_events (type, payload) VALUES ($1, $2)',
    [notificationType, JSON.stringify(message)]
  );
  
  return NextResponse.json({ received: true });
}

The Dashboard: Everything You Need

FreeResend includes a full admin dashboard for managing your email infrastructure:

The Challenges and Solutions

The Results: Enterprise Email at SES Prices

Feature Parity with Resend

Deployment Options

FreeResend is designed for flexible deployment:

Conclusion: Own Your Email Infrastructure

FreeResend proves you don't need to choose between great developer experience and cost efficiency. By leveraging AWS SES as the delivery backbone and matching Resend's API exactly, you get:

• Drop-in replacement: Existing Resend SDK code works unchanged
• 90% cost reduction: SES pricing vs SaaS email services
• Full control: Your AWS account, your data, your infrastructure
• Open source: Inspect, modify, contribute—it's your code now

For solopreneurs and teams running multiple products, the savings compound quickly. And when you own the infrastructure, you never worry about API pricing changes or service shutdowns.

Email is critical infrastructure. Now you can own it completely.