Free tools Windows power users keep installed
One-click scans. No signup required.
To send transactional email from Node.js, create a reusable mail transport, authenticate it with an SMTP provider or supported email service, and submit messages through that transport. Nodemailer handles message composition and submission; the provider handles delivery. For production, add domain authentication, durable queuing, retries, and delivery monitoring rather than treating a successful SMTP connection as proof an email reached an inbox.
Choose the sending service before writing the mail function
Nodemailer is a Node.js library for composing and sending messages. It is not itself an email-delivery service: its transporter connects to an SMTP server or another supported transport, and that service processes delivery. Nodemailer documents the basic flow as creating a transporter, composing a message, and calling sendMail(). Reuse the transporter instead of creating one for every message. The current Nodemailer 10 documentation requires Node.js 20 or later; check the project’s release requirements when selecting a version. See Nodemailer and its SMTP transport documentation.
As an Amazon Associate I earn from qualifying purchases.
For an application’s production path, choose a service intended for application email and verify its current SMTP or API integration, sending limits, bounce and complaint reporting, support, and operational requirements against the provider’s own documentation. Nodemailer names Amazon SES, SendGrid, Postmark, and Mailgun as dedicated-service examples. The available evidence does not establish their current quotas, prices, or relative deliverability, so those should be compared directly rather than assumed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why personal Gmail is usually not the production default
Nodemailer describes Gmail as a convenient option for testing, but does not recommend it for production workloads. Gmail is designed for individual users, and its security systems may block suspicious automated access. Use a dedicated email provider when the application needs dependable operational controls and visibility into delivery outcomes. See Nodemailer’s Gmail guide.
#1 Best Overall
Configure a reusable authenticated SMTP transport
The following ESM example shows the configuration pattern. It is illustrative, not a tested delivery setup: the host, credentials, sender address, provider-specific TLS requirements, and retry/outbox integration must match your service.
import nodemailer from "nodemailer";
const transporter = nodemailer.createTransport({
host: process.env.SMTP_HOST,
port: Number(process.env.SMTP_PORT ?? 587),
secure: process.env.SMTP_PORT === "465",
auth: {
user: process.env.SMTP_USER,
pass: process.env.SMTP_PASS,
},
});
export async function sendVerificationEmail({ to, url }) {
return transporter.sendMail({
from: process.env.MAIL_FROM,
to,
subject: "Verify your email address",
text: `Verify your email address: ${url}`,
html: `<p>Verify your email address: <a href="${url}">Continue</a></p>`,
});
}Match the port to the provider’s TLS settings
A common SMTP configuration uses port 587 with secure: false, allowing the connection to upgrade with STARTTLS. Port 465 typically uses TLS from the start with secure: true. Nodemailer upgrades to STARTTLS when it is available unless explicitly disabled. Follow the provider’s exact connection instructions; do not turn off TLS certificate verification in production. See Nodemailer’s SMTP transport documentation.
Keep credentials and message content safe
- Supply SMTP credentials through deployment secrets or environment configuration, not source control. Use OAuth2 where the provider supports it.
- Do not log credentials or sensitive message bodies. Nodemailer’s
transactionLogoption can record SMTP commands and responses without message content. - Escape untrusted values before inserting them into HTML. In particular, do not interpolate untrusted input into a link or markup without appropriate validation and HTML escaping.
- Use expiring, single-use tokens for verification and password-reset links; do not place a reusable credential in an email URL.
Send text and HTML alternatives
Providing both text and html gives recipients’ mail clients alternatives; Nodemailer builds a multipart message when both are supplied. Keep the plain-text content useful on its own, and ensure HTML values are safely constructed. A successful call to sendMail() indicates submission to the configured transport, not guaranteed inbox placement.
Check configuration without mistaking it for deliverability
Call transporter.verify() during setup or a controlled health check to test DNS resolution, server connection, TLS upgrade where applicable, and authentication. It does not prove that a particular sender address will be accepted, nor that a message will arrive in an inbox. Actual sends can still be rejected by sender policy, bounced later, or filtered. Monitor provider outcomes and treat a transport check as one diagnostic signal, not an end-to-end delivery test.
Authenticate the sending domain
Configure SPF, DKIM, and DMARC for the domain used to send mail. Use the selected provider’s DNS instructions rather than copying generic records: the required values and alignment depend on the provider and domain setup. NestJS’s official mail guidance recommends all three. AWS SES documentation explains that SPF and DKIM contribute to DMARC authentication and that Return-Path is involved in handling bounces and complaints. See NestJS mail documentation and the AWS SES Developer Guide.
Make business-triggered email durable
If an email must correspond to a database change—such as a receipt after payment or an account-verification message after registration—avoid making the user-facing request depend on a single immediate SMTP call. Persist the business change and an outbox record in the same database transaction, then have a worker dispatch pending messages asynchronously. This prevents a process crash between the committed business event and the attempt to send its email from silently losing the work. NestJS’s mail documentation discusses sending after commit through an outbox and monitoring mail events or sent/failed diagnostics: NestJS mail documentation.
Define retries and observe outcomes
- Choose retry behavior based on provider error semantics and outage duration. Distinguish transient failures from permanent rejection so retries do not become endless or create duplicate messages.
- Track send failures and latency, and surface provider-reported bounces and complaints where available. Maintain suppression behavior so addresses that should not be retried are not repeatedly mailed.
- Make dispatch safe to repeat. A worker may retry after an uncertain failure, so use message identifiers or application-level idempotency where appropriate and avoid duplicating consequential actions.
- Keep logs operationally useful without recording credentials or sensitive message bodies. Nodemailer’s
transactionLogcan help diagnose SMTP interactions without logging the message content.
Keep message headers separate from SMTP routing
The visible From, To, and Subject headers are not the same as the SMTP envelope’s MAIL FROM and RCPT TO routing instructions. Nodemailer normally derives the envelope from message fields, but it can be overridden, for example to use a dedicated bounce address or VERP-based per-message or per-recipient bounce tracking. Plan how that routing will connect to bounce handling before relying on it. See Nodemailer’s SMTP envelope documentation.
Separate sending from receiving
Nodemailer sends email; it does not receive it. If your application needs inbound mail processing, such as replies, that requires a separate receiving service or mail infrastructure. Nodemailer’s documentation states: “Nodemailer sends email. It does not receive it, and it never will: accepting mail is a different problem with different infrastructure, and bolting it onto a sending library would serve neither purpose well.” See Nodemailer’s receiving-email guide.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
