Email and notifications

SMTP (Simple Mail Transfer Protocol) dates from 1982 and still carries email between servers today. A sending server looks up the recipient domain's MX records in DNS, connects to that mail server on port 25 and hands over the message. Apps and mail programs submit mail to their own provider on port 587 (upgraded to encryption with STARTTLS) or 465 (encrypted from the start), logging in with a username and password.

Every sending service (Resend, SendGrid, Amazon SES, Postmark) offers an SMTP relay, so frameworks, WordPress plugins and older software can send without custom code, and each also offers an HTTP API, which is usually quicker to call and returns clearer errors. Many clouds block outgoing port 25 to fight spam, one more reason apps send through a relay. SMTP only sends mail; reading a mailbox uses IMAP or POP3.

Transactional email is triggered by an event in the app and expected by the person receiving it, so people look out for it. Marketing or bulk email goes to many people at once and needs consent and an unsubscribe link. Keeping the two apart, on separate streams, IP addresses or subdomains, stops a badly received campaign from dragging password resets into spam.

Apps build these emails from templates (React Email, MJML or the provider's own editor) and send them through an API such as Resend, Postmark, Amazon SES or SendGrid, often from a background job so a slow send never holds up the page. Good habits: a real reply-to address, a plain-text version alongside the HTML, and short-lived links for resets and logins.

Resend comes from the team behind React Email, an open-source library for writing emails as React components that render to HTML most email programs display correctly. Sending is a single API call or SMTP, with SDKs for Node.js, Python, PHP, Ruby, Go, Rust, Java and more, and guides for Next.js and serverless platforms.

You verify a domain by adding the DNS records it shows (SPF and DKIM, plus DMARC if you choose), then send from any address on that domain. Webhooks report deliveries, bounces, complaints and opens; Broadcasts cover newsletters on separate plans billed by contacts; and inbound email can be received and passed to your app. Each To, CC or BCC recipient counts as a separate email.

SendGrid started in 2009 and Twilio has owned it since 2019. It offers an Email API and SMTP relay for app email, dynamic templates, event webhooks, Inbound Parse (which turns received email into webhook calls), suppression management and deliverability tools, plus a separate Marketing Campaigns product with contact lists, a visual editor, sign-up forms and automations.

Its size is both the appeal and the catch. It handles very large volumes and integrates with most platforms, but new accounts go through checks meant to keep spammers out, and on shared IP addresses your delivery depends partly on how other senders behave unless you pay for a dedicated IP. The permanent free plan ended in 2025 and was replaced by a 60-day trial.

SES (Simple Email Service) is part of AWS. You verify a domain, send through its API or SMTP interface, and receive feedback through other AWS services: bounces, complaints and deliveries arrive as events through SNS or EventBridge. SES keeps a suppression list of addresses that bounced or complained, and offers templates, dedicated IPs, a deliverability dashboard (Virtual Deliverability Manager) and inbound email through Mail Manager.

New accounts start in a sandbox that can only send to verified addresses, up to 200 emails a day, until AWS approves a request for production access, which asks how you collect addresses and handle bounces. Since July 2026 new accounts begin on a bundled Essentials plan; the older pay-per-use à la carte pricing is still available and is cheaper for plain sending.

Postmark splits transactional and broadcast (bulk) email into separate message streams, and broadcasts go out from separate IP addresses, so a newsletter never slows down or taints a login code. It offers an API and SMTP, templates with shared layouts, 45 days of full message history by default, detailed bounce data, inbound email turned into JSON and sent to a webhook, and public delivery-time statistics.

It is known for strict rules: it does not accept purchased lists or cold outreach, and a new account can only email addresses on its own domain until Postmark approves it. ActiveCampaign has owned it since 2022. Plans are priced by monthly volume rather than by contacts, with no daily sending limit.

SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send mail for a domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message, checked against a public key published in DNS, so tampering shows. DMARC ties both to the visible From address and tells receivers what to do when checks fail (p=none to monitor, quarantine or reject) and where to send reports.

Since February 2024, Gmail and Yahoo have required SPF or DKIM from every sender, and all three, plus one-click unsubscribe on marketing mail, from anyone sending more than 5,000 messages a day to their users; Microsoft set similar rules for Outlook.com in 2025. Email services show the exact records to add when you verify a domain. Once DMARC is enforced, BIMI can show a brand logo beside messages in some inboxes.

Inbox providers such as Gmail and Outlook score every message using the sending domain's and IP address's history, authentication (SPF, DKIM, DMARC), how recipients react (opens, replies, spam reports) and the content itself. A high bounce rate from old or mistyped addresses, or spam complaints above about 0.3% (the limit Gmail publishes), quickly pushes mail into spam.

Habits that help: send only to people who asked for it, confirm sign-ups, remove bounced addresses automatically, keep marketing on a separate subdomain or stream from password resets, warm up a new domain or dedicated IP by raising volume gradually, and put a working unsubscribe link in anything promotional. Google Postmaster Tools shows how Gmail sees your domain.

The app asks the user for permission, and the operating system gives it a device token, an address for that app on that device. The app sends the token to your server. To notify the user, the server sends a message with the token to the platform's push service (APNs for Apple devices, FCM for Android, the browser's push service on the web), which delivers it and wakes the app if needed.

Permission is the gate: iOS has always asked, Android asks from version 13, and people who get too many alerts switch them off or uninstall. Messages can be visible notifications or silent data messages that update the app in the background, and delivery is not guaranteed. Services such as OneSignal and Expo's push service wrap the platforms behind one API.

An app registers with FCM through the Firebase SDK and receives a registration token. Your server sends messages to the FCM HTTP v1 API, authenticated with a short-lived OAuth token from a service account, addressed to one token, a topic that devices subscribe to, or a condition across topics. On Android, FCM delivers through Google Play services; on iOS it forwards to APNs using an APNs key you upload; on the web it uses the browser's web push.

Messages come in two kinds: notification messages, which the system shows automatically when the app is in the background, and data messages, which your own code handles. Payloads are limited to 4 KB. The legacy API, which used a fixed server key, was switched off in 2024, so older tutorials need updating. Battery savers on some Android phones can delay delivery to apps that are not in use.

Your server opens an HTTP/2 connection to APNs and sends a JSON payload (up to 4 KB) addressed to a device token. It authenticates with a signed token (a JWT) made from a .p8 key in your Apple Developer account, which works for all your apps, or with older per-app certificates that must be renewed every year. There are separate sandbox and production environments, and a token from a development build only works with the sandbox.

APNs also carries silent background updates, incoming call alerts and Live Activity updates. Apple limits how often background pushes wake an app, to protect battery life, and users control alerts for each app in Settings. Services such as FCM and OneSignal still hand iOS notifications to APNs behind the scenes.

A site registers a service worker and calls the Push API, and the browser asks the visitor for permission. The browser returns a subscription (a push service URL plus encryption keys) that the site stores on its server. To notify, the server sends an encrypted message to that URL, signed with the site's VAPID key pair; the browser maker's push service delivers it, and the service worker shows the notification.

It works in Chrome, Edge, Firefox and Safari. On iPhone and iPad (iOS 16.4 and later) it only works for sites the user has added to the Home Screen as a web app. Browsers expect the permission request to follow a click rather than appear on page load, and libraries such as web-push for Node.js handle the encryption and signing.

Your server calls the gateway's API with a phone number and a message; the gateway routes it to the mobile operators and reports delivery back through a webhook or a status API. Messages are charged per segment: 160 plain characters, or 70 when the text uses emoji or Indian scripts. Twilio, Vonage, Plivo and Infobip work worldwide; MSG91, Gupshup and similar providers focus on India, often with ready-made OTP widgets.

India adds DLT (distributed ledger technology) registration under TRAI rules. A business registers as a principal entity on an operator's DLT portal (Jio, Airtel, Vi or BSNL), then registers its sender IDs (six-character headers) and every message template, with placeholders for the parts that change. Messages that do not match an approved template are blocked, links must be whitelisted, and since 2025 headers carry a suffix such as -S or -T that shows the message type.

The first portal charges a registration fee of about ₹5,000 plus GST. International routes skip DLT but deliver from random numbers. Prices vary widely: Twilio lists about $0.083 a message to India, while Indian providers charge a fraction of a rupee. Some apps send login codes over WhatsApp first and fall back to SMS.

A business verifies itself with Meta, registers a phone number and uses the Cloud API, which Meta hosts, either directly or through a Business Solution Provider (BSP) such as Twilio, Gupshup, Interakt or MSG91 that adds a dashboard and its own fees. Messages to people who have not written in recently must use templates approved in advance, in three categories: marketing, utility (order and account updates) and authentication (login codes).

When a user messages the business, a 24-hour customer service window opens, and free-form replies are allowed inside it. Since July 2025, Meta has charged per delivered template message, with the rate set by category and by the recipient's country. From 1 October 2026, service replies are charged too, after 1,000 free a month per business number, and utility templates sent inside the window are no longer free.

People must opt in before a business messages them. New numbers start with a daily limit on how many people they can contact first, which rises while the number's quality rating stays good; blocks and reports lower that rating.

A Telegram bot is created by messaging @BotFather, which returns a token; your server then calls the Bot API over HTTPS (sendMessage with a chat id) to post into a private chat, group or channel. Bots can only message people who have started a chat with them first, and Telegram asks bots to stay under about 30 messages a second overall and 20 a minute in any one group.

A Discord webhook is a secret URL created in a channel's settings; posting JSON to it (text, embeds, a name and an avatar) drops a message into that channel with no bot account needed. Slack's incoming webhooks work the same way. They suit internal alerts rather than customers: anyone holding the URL or token can post, so keep it in environment variables, and expect rate limits during bursts.