A small newsletter can live in a modest, inspectable application—but self-hosting means taking responsibility for consent, mail authentication, delivery, backups, and uptime. Mr Say Nothing reports building a 1,258-line newsletter server with TypeScript, Svelte, SQL, and Node’s SQLite interface for a small list that receives one email per post. It is a case study in a deliberate trade: keep subscriber data and code close at hand, and accept the work that a hosted platform would otherwise handle.
What does the 1,258-line server do?
In his September 2026 account, Mr Say Nothing describes a compact system built around a SQLite database file. Its subscription flow supports double opt-in, and its sending CLI takes a post from a file. Before sending, a dry run renders both text and HTML for review. The application also includes a health endpoint.
As an Amazon Associate I earn from qualifying purchases.
The author counts 215 lines for the CLI and 1,043 consent-related lines. Those are his reported figures for this implementation, not an independent code review or a benchmark of how much code a newsletter needs. As he puts it, “A newsletter is three endpoints, two tables, and one email header most platforms hide from you.”
Recommended Free Tools
Subscriber records and sending history
The described database has a subscribers table with constrained states—pending, confirmed, and unsubscribed—plus a sends table used as an audit trail. Keeping these records in SQLite makes the data a file the operator can inspect and move, while also making database care part of operating the service.
#1 Best Overall
Confirmation and unsubscribe links
Rather than using server-side sessions or a token table, the implementation signs confirmation and unsubscribe tokens with HMAC. The author says unsubscribe tokens do not expire and that the signing key is kept outside the repository. He also describes a honeypot field, request and resend limits, and responses intended not to reveal whether an address is already subscribed. These are design details reported by the author, not independently audited security findings.
Why self-host a newsletter at all?
For this author, the fit was specific: a small list, one email per post, and other services already running in the same environment. The appeal was direct custody of subscriber data and the ability to inspect the implementation. A SQLite file is easier to understand and move than data locked behind an unfamiliar service, but it does not remove the need to operate a reliable mailing system.
A hosted newsletter service generally offers convenience and an established sending reputation; self-hosting offers more direct control over data and code. The decision is less about a universal subscriber-count cutoff than the operator’s priorities and capacity.
Rank #2
| Decision factor | Self-hosting may suit you when… | A hosted platform may suit you when… |
|---|---|---|
| List and cadence | Your list and sending schedule are modest enough for you to manage the workflow. | You need to run more complex or frequent campaigns without building the surrounding system. |
| Data custody | You value direct access to subscriber records and a portable database file. | You prefer a service to manage data access and the sending interface for you. |
| Delivery reputation | You can configure and monitor sender authentication and delivery. | You value a provider’s sending infrastructure and reputation, while still verifying your domain setup. |
| Time and expertise | You are willing to maintain code, email configuration, backups, and process supervision. | You would rather spend that time writing and managing the newsletter. |
| Features | A single list and a manual or timer-triggered send are enough. | You need built-in segmentation, scheduling, or tracking. |
There is no established list-size threshold at which one option automatically wins. The relevant question is whether the value of owning a small, understandable system outweighs the continuing operational work for your situation.
How does double opt-in work without a session?
In this implementation, a subscriber begins in pending state. The confirmation link carries a signed token; following it verifies the token and advances the subscriber’s status to confirmed. The database stores the state, while the signed link supplies the authorization for the confirmation action without requiring a server-side session or a separate token table.
The author favors a confirmation link that can be validated independently of a live database session: “A confirm link that still works when the database is asleep is one less thing that can rot.” That is the rationale behind this design, not a general security guarantee. Token signing, key protection, link handling, and state changes still need to be implemented correctly.
Unsubscribing and one-click headers
The system also uses a signed token for unsubscribe authorization. The author says its unsubscribe route accepts cross-origin POST requests because email receivers initiate one-click requests. In this particular implementation, the signed token authorizes the action; that choice should not be read as a universal prescription for handling cross-origin requests.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →RFC 8058 defines the one-click list-unsubscribe mechanism using email headers and a POST request. Google’s current sender guidance for personal Gmail accounts says senders exceeding 5,000 messages per day to Gmail accounts must support one-click unsubscribe for marketing and subscribed messages, as well as provide a visible unsubscribe link. The specified headers are List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click. This is Gmail-specific guidance; it does not establish the rules of every email provider.
Is a self-hosted newsletter deliverable?
It can send mail, but control over the application does not itself establish sender reputation or inbox placement. Google’s requirements for mail to personal Gmail accounts include SPF or DKIM authentication, valid forward and reverse DNS, TLS, and keeping the reported spam rate below its stated threshold. For senders above 5,000 messages per day to Gmail accounts, Google adds SPF, DKIM, and DMARC requirements, including alignment requirements for direct mail. The applicable scope and details are in Google’s sender guidelines.
Rank #4
Mr Say Nothing reports a Mail-Tester score of about 5/10 before DKIM alignment and says stricter receivers could put the mail in junk. That is the author’s result for this particular setup at the time of writing, not a controlled test, representative average, or score for self-hosted newsletters in general. He identifies an email relay as one possible way to address sending infrastructure if the list’s needs justify it. A relay cannot promise inbox placement: Google says senders remain responsible for following its guidance and should verify that a provider authenticates their domain correctly.
Google also notes that authentication can make messages less likely to be rejected or marked as spam, but does not guarantee that mail from third-party providers will pass spam filters. Self-hosting therefore requires attention to both the sending configuration and the receiving providers’ rules.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why use node:sqlite instead of Postgres?
The author’s stated priorities make SQLite a practical fit: the list is small, subscriber data sits in a file, and the implementation can run alongside services already in the same environment. A single file is easy to inspect and copy, and avoids adding a separate database service to this particular setup.
That is a context-specific choice, not evidence that SQLite is always preferable to Postgres. The account does not establish a general scale limit or compare database performance. Choose based on the operational setup, data needs, and database responsibilities you are prepared to own.
What are the trade-offs and operating chores?
The system deliberately omits features that a broader newsletter product might offer. It has one list, no segments, no open tracking, and no built-in scheduling beyond manually running the CLI or triggering it with a timer. These omissions keep the application focused, but they matter if your publishing workflow depends on those capabilities.
The author describes backups as copying and restoring the SQLite database file, with WAL mode in use. That account is specific to this system and is not a general backup procedure for every SQLite database using WAL. Process supervision is another operational responsibility: the service needs to stay available and be monitored rather than simply existing as code.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesImplementation snags the author encountered
- Container build: a build failed because the esbuild install script had not been approved in the pnpm setup.
- Unsubscribe request: a same-origin or CSRF check conflicted with Gmail’s cross-origin one-click unsubscribe POST.
- Mail delivery: delivery performance was weak before DKIM alignment.
These are incidents from the author’s build, not inevitable problems in every newsletter system. They show how a small application can still involve dependencies, email-client behavior, authentication configuration, and ongoing operations beyond writing the send function.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
