| Version | 0.0.1 |
|---|
| Status | M1 guardrails implemented — see gateway tests m1Deliverability.test.ts |
Email Deliverability & Domain Reputation — Product Plan
> Purpose: Decision framework for @anoobot.com abuse risk, outbound mail, and self-hosted only vs managed cloud deployment paths. > > Cross-reference: anoobot-business-model.md · website.md · feature-flags.md · packages/gateway/src/routes/domains.ts · infrastructure/terraform/aws-eks-tenant/
1. Executive recommendation
| Phase | Strategy | Rationale |
|---|
| Year 1 | Self-hosted only for free + paid | Lowest domain-reputation risk, lowest abuse cost, matches “sovereign inbox” positioning |
| Year 2+ | Managed cloud for any paid plan | Revenue attach (+$4/user/mo hosting); requires outbound-mail guardrails before GA |
| Never (without controls) | Centralized free @anoobot.com outbound SMTP | Highest blacklist and abuse cost |
2. Architecture context (current codebase)
| Component | Behavior |
|---|
@anoobot.com | Free identity/discovery namespace — routes to the user’s self-hosted instance; not centralized hosted outbound email |
| Inbound relay | Go SMTP relay — encrypt-on-receipt; STARTTLS required (packages/relay/) |
| Compose / send | Client encrypts → POST /api/v1/messages → mesh/directory delivery to other anoobot users |
| Custom domain | DNS TXT verified; anoobot.com cannot be claimed as a custom sending domain |
| Managed cloud | Per-tenant EKS (Terraform); gated by VITE_ENABLE_MANAGED_CLOUD + MANAGED_PROVISIONER_LIVE |
| Outbound internet SMTP | Not implemented as a centralized product feature today |
3. Master decision table — self-hosted vs managed cloud
| Dimension | Self-hosted only | Managed cloud |
|---|
| Who runs mail infra | Customer (Docker/K8s on their IP) | Anoobot (per-tenant EKS on AWS, or BYO via STS) |
@anoobot.com role | Identity address → routes to their instance | Same identity model; tenant at per-tenant ALB / MANAGED_CLOUD_BASE_URL |
| Outbound mail path | Customer IP if they configure relay; no central Anoobot SMTP pool | Inbound relay on tenant cluster; outbound internet mail requires explicit product decision |
anoobot.com blacklist risk | Low — abuse hits customer IP; SPF/DKIM for anoobot.com won’t authorize random self-hosters | Medium–High if outbound is centralized under anoobot.com or shared IPs |
| Free-tier spam risk | Distributed across instances; hard to abuse at scale | Concentrated on Anoobot IPs/domains if free users are hosted |
| Infra cost to Anoobot | Low — registry, directory, updates, support | High — EKS tenant (VPC+ALB+cluster), ops, monitoring, SLA cron |
| Abuse handling cost | Account suspension + directory delist | Deliverability remediation, abuse desk, legal |
| Revenue model | License only ($5/user/mo Team, volume bands) | License + $4/user/mo hosting; target 5% Y2 → 25% Y5 managed attach |
| Buyer persona | Privacy/devops, law firms with IT, sovereign deploy | SMB without DevOps |
| GTM timing | Year 1 — sovereign inbox wedge | Year 2 beta — after control-plane soak |
| Code readiness | Shipped | Code complete; live AWS proof pending |
4. Abuse scenarios — @anoobot.com (e.g. adam@anoobot.com)
| Scenario | Self-hosted only | Managed cloud |
|---|
| Free user sends many marketing emails | Mail leaves user’s IP (if outbound exists); anoobot.com unlikely blacklisted; user IP may be | On managed + shared outbound: anoobot.com / shared IP at risk |
User spoofs From: user@anoobot.com to Gmail | SPF/DKIM fail → spam/reject; hurts sender IP, not Anoobot domain | Same unless Anoobot signs mail for @anoobot.com centrally |
User spams other @anoobot.com users (mesh) | Suspend account in registry; no public SMTP blast | Same + per-tenant rate limits |
| Cost if abuse happens | Support time (hours) | Support + deliverability firefight (days, significant $) |
5. Cost model (order of magnitude)
| Cost line | Self-hosted only | Managed cloud |
|---|
| Per free user | ~$0.01–0.10/mo (registry + directory) | Do not host free users — EKS tenant cost >> $0 |
| Per paid domain (~10 users) | License margin; no hosting COGS | License ~$50/mo + hosting ~$40/mo; EKS baseline ~$150–300+/mo per tenant until density improves |
| Abuse incident | Low $ | $500–5K+ (IP warmup, support, provider fees) |
| Anti-abuse stack | Optional / light | Required before GA — budget ~$100–500/mo + engineering |
6. Product policy (recommended)
| Policy | Self-hosted only | Managed cloud |
|---|
| Free tier on this path? | ✅ Yes — 1 user, @anoobot.com or custom domain | ❌ No — any paid plan only |
| Sending domain ownership | Customer custom domain (DNS TXT verified) | Customer custom domain or subdomain (e.g. mail.customer.com) — not shared root anoobot.com |
Central @anoobot.com outbound SMTP | ❌ Never | ❌ Never for free; paid only with strict limits if ever offered |
| Outbound to internet (Gmail, etc.) | Customer brings SMTP / future optional relay docs | Per-tenant relay or transactional provider (SES/Postmark) with dedicated subdomain |
| Send quotas | Soft mesh limits + abuse reporting | Hard limits (e.g. 500/day paid), burst caps, auto-suspend |
| Required before launch | Directory abuse reporting, account suspend API | + SPF/DKIM/DMARC, bounce webhooks, complaint loop, SLA monitoring |
7. Phased rollout
| Milestone | Self-hosted | Managed cloud |
|---|
| M0 (now) | Free @anoobot.com + custom domain; inbound relay; mesh send | Gated off (MANAGED_PROVISIONER_LIVE=false) |
| M1 (Y1 GA) | Abuse: suspend user in registry; document “@anoobot.com is identity, not bulk mail” | — |
| M2 (Y2 beta) | Keep free self-hosted; convert at user #2 | Paid checkout, lapse offboard, beta soak — managed-cloud-beta.md |
| M3 (Y2 GA) | Optional customer SMTP relay — self-hosted-smtp-relay.md | Per-tenant outbound subdomain, webhooks, blocklist — outbound-mail-ga.md ✅ |
| M4 (Y3+ scale) | Community + legal wedge | Target 25% managed attach; improve multi-tenant unit economics |
8. Path chooser
| If the priority is… | Choose |
|---|
Protect anoobot.com reputation | Self-hosted only (Year 1) |
| Minimize infra burn on free users | Self-hosted only |
| “No DevOps” revenue (+$4/user/mo) | Managed cloud (paid only, Year 2+) |
| Law-firm sovereign deploy | Self-hosted |
| Fast SMB signup without IT | Managed cloud (after guardrails) |
| Allow free marketing blasts | Neither — not in product scope without anti-abuse stack |
9. Engineering backlog (managed GA blockers)
When managed cloud sends internet mail, implement before GA:
- No free tenants on managed — billing + provisioner enforcement ✅ (M1)
- Per-tenant or per-customer sending subdomain — never bare
@anoobot.com as shared pool ✅ (M3)
- Rate limits — daily/hourly send caps by plan slab ✅ (M1 mesh limits)
- Bounce and complaint webhooks — auto-suppress bad recipients ✅ (M3)
- Account suspend API — registry delist + tenant pause ✅ (M1 + M3 auto-suspend)
- SPF/DKIM/DMARC — for any Anoobot-operated sending subdomain only ✅ (M3 DNS templates)
- Blocklist monitoring — Spamhaus, Google Postmaster, etc. ✅ (M3 RBL cron)
10. Summary
- Keep free tier on self-hosted only —
@anoobot.com stays identity/directory, not shared outbound mail.
- Launch managed cloud Year 2 for any paid plan — aligns with managed attach targets in the business model.
- Do not place free users on managed — EKS economics and spam concentration both argue against it.
- If managed sends internet mail, use customer subdomains or customer-owned domains — not a shared
@anoobot.com sending pool.
- Build anti-abuse before managed GA — cheaper than recovering a blacklisted domain.