Prepare mail delivery first
Complete mail server configuration and send a disposable message through the intended domain before attaching delivery to a product operation. Verify DNS, TLS, relay policy, sender identity, storage, and retry behavior independently.
Define a narrow action contract
Accept only the product inputs the caller should control, such as a record public ID and validated message data. Resolve recipients and sensitive context from server-owned records when possible. Do not accept an arbitrary relay host, sender, template path, or unrestricted recipient list from an untrusted client.
- Create or select a template and render it with disposable data.
- Define an action input schema and reject missing, malformed, or oversized values.
- Authorize Execute separately from permission to read the referenced record.
- Add the mail outcome and queue the message through the server-side mail path.
- Invoke the action as the real application role and retain its response.
Verify queueing, delivery, and failure separately
- The action returns the documented result and creates the expected queued/outbox record.
- The worker delivers to a disposable inbox and records success.
- After a temporary SMTP failure, the message stays in the queue for another attempt.
- A permanent invalid recipient reaches a bounded failure state.
- An unauthorized caller cannot execute the action or read another user’s message context.
Operate the workflow
Monitor queue age, attempts, last error, delivery latency, and domain-level failures. Redact credentials and message bodies from ordinary logs. Provide a controlled way to stop retries, inspect a failed item, and replay only after the cause is understood.