The backend sends email through Resend's HTTP API — not SMTP. This works on Render, Railway and other hosts that block outbound mail ports. This guide creates an API key, verifies a sender domain, configures the environment and proves delivery.
Resend sends mail over HTTPS (port 443), so it is not affected by hosts that block SMTP ports 25, 465 and 587. The backend uses it for registration verification, password-reset codes and the mandatory Google OAuth sign-in OTP. The email service never throws: failed delivery is logged and returned as { success: false }, so authentication flows keep working.
No SMTP handshake, no blocked-port errors and no Gmail App Password.
Transient failures (429 / 5xx / network) are retried with exponential backoff; permanent errors (invalid key, unverified sender) are returned immediately.
Without RESEND_API_KEY the backend logs the email to the console instead of sending it, so local development and CI still run.
Resend only lets you send from a domain you have verified (or from onboarding@resend.dev, which can only send to the Resend account owner). Add the domain, publish the DNS records Resend shows, and wait for the Verified badge.
1
Add the domain
In Resend open Domains → Add Domain, enter your domain (for example yourdomain.com) and choose a region close to your users.
2
Publish the DNS records
Copy the SPF, DKIM and (optionally) DMARC records into your DNS provider. DNS propagation can take a few minutes to a few hours.
3
Set the sender
Use an address on that domain in RESEND_FROM, for example "Your Brand <noreply@yourdomain.com>". A Gmail address will not work as the sender.
RESEND_FROM takes precedence. EMAIL_FROM is still accepted as a legacy fallback so existing deployments keep working, but new setups should use RESEND_FROM. RESEND_REPLY_TO and the retry variables are optional.
nodemon watches JS files only — .env edits require a manual restart. Stop the server (Ctrl+C) and run pnpm dev again.
2
Send a real test email
backend
pnpm test:email you@example.com
# [OK] Email accepted by Resend (message id: 4ef9...)
# Check the recipient inbox and the Resend dashboard logs.
The script reads backend/.env, sends one HTML + text message through Resend and exits non-zero on failure, so it also works in CI. It does not expose a public email endpoint.
3
Test the real flows
Register an account, request a password reset, and sign in with Google. Each flow should produce an email, and the backend log should show Email sent successfully via Resend with a message id.
4
Check the Resend dashboard
Open Emails in the Resend dashboard to see delivery, bounce and complaint events. This is the fastest way to distinguish “the API accepted it” from “the inbox received it”.
Add the key, restart the backend, and run pnpm test:email again
invalid_api_key / 401 Unauthorized
The key is wrong, revoked or from another account — create a new key and replace it
validation_error or invalid_from_address
RESEND_FROM is not on a verified domain; verify DNS first. onboarding@resend.dev can only email the account owner
Email accepted but never arrives
Check Spam, then the Resend Emails dashboard for bounce/complaint events; confirm SPF and DKIM records
429 or 5xx from Resend
The service retries automatically; check the Resend quota and dashboard if it keeps failing
Log shows “EMAIL (fallback …)”
RESEND_API_KEY is missing — this is the intended development fallback, not a crash
If nothing above matches, run pnpm test:email you@example.com and share the exact error line. The script prints the Resend status code and message, which is what support needs.