A self-hosted email operating system, built to survive Gmail.

Context

A high-volume sender had outgrown its SaaS email platform, and the failure modes were expensive: a single unsubscribe silently killed every newsletter at once, a ten-domain sending reputation was in a constant fight with Gmail, and an over-eager validator had false-positive-deleted nearly two thousand real subscribers.

What we built

We built a self-hosted email operating system. Ten dedicated sending domains, one per product line, each driven by an automated warm-up state machine with ramp plans and probe-then-decide gates; per-domain provisioning (DKIM/SPF/DMARC) against Mailgun and Cloudflare; and multi-signal address validation built specifically to stop the false-positive deletions. On top of the sending layer: a durable, concurrency-safe journey engine with a visual graph builder and twelve individually tested step-handlers; 36 version-controlled MJML templates with a render-time lint that hard-fails any campaign missing a physical address or unsubscribe link; per-list subscription state; RFC 8058 one-click unsubscribe with a preference center; suppression scopes and a cross-product cadence guard; and first-party open/click/bounce analytics feeding a reusable engagement-recency model.

The value

• The organization moved off a rented ESP onto infrastructure it controls: no per-contact SaaS pricing, and no platform lock-in on its own audience.
• 1,861 real subscribers were saved from wrongful deletion, and per-list governance ended the single-unsubscribe collapse that was quietly killing every newsletter.
• Deliverability is now an engineered, monitored system. Warm-up state machines and per-domain reputation replaced the daily fight with Gmail.
• Compliance (physical address, one-click unsubscribe, per-list consent) is enforced in code at send time, removing a whole class of legal risk from human discipline.