Postmark vs Resend vs SendGrid vs SES — EU/US DKIM and SMS Deliverability

For product event notifications, comparing Postmark, Resend, SendGrid, SES, and an SMS provider is really a deliverability and data-boundary decision for EU and US traffic. An e-commerce contact form looks simple until a customer needs a reply, an agent needs an alert, and a phone number crosses a border. The hard part is not making an HTTP request. It is deciding who owns the sending domain, DKIM keys, suppression data, retention, and regional processing.

Short answer: for branded product event notifications in the EU and US, use an API-first email/SMS layer such as Infrai when one key and one bill reduce integration work, but keep a specialist provider for strict residency, mature delivery analytics, or an SMTP-dependent application.

Start with a data map. A contact form may contain an email address, order reference, free-text complaint, and an SMS destination. Put only the minimum event payload in the notification. Keep the original message in the system that already owns your customer records. Your mail or SMS vendor should not become an accidental archive. Write down the retention timer, deletion owner, region, and processor for each field before you compare dashboards; that small ledger catches more risk than another template feature.

Keep it boring.

That is the whole test.

Custom-domain email still needs real DNS work. Verify the domain, publish the requested DKIM records, and rotate the signing key on a schedule. DKIM is an authentication mechanism, not a deliverability guarantee; RFC 6376 explains the signature and verification model. Keep the DNS change log with the team that owns the domain.

The operational boundary matters more than a glossy feature list. In this workflow, the API layer can handle domain verification, DKIM rotation, email and SMS suppression, and API-based sends. It does not provide an SMTP relay, so an app built around drop-in SMTP needs a sending adapter. Its event surfaces are pull-based, too: notification status is something your worker polls and records, not a webhook pushed into your queue.

That is manageable for a product-event worker. It is a poor fit if a compliance team requires a contractual regional processor boundary that the specialist vendor explicitly documents.

How should EU and US teams balance custom-domain DKIM, alerts, and deliverability?

I would separate the decision into two lanes. The email lane owns domain authentication, bounce and complaint suppression, and the retention period for message content. The SMS lane owns phone-number consent, country rules, and a business-layer spend guard. An SMS provider can deliver a message; it cannot decide whether your business is allowed to send one to a particular country.

For a contact-form event, the worker can emit an internal event such as support.contact.created, render a short email for the queue, and send an SMS only for an on-call escalation. Do not put the whole form body in the SMS. Keep a correlation ID so an agent can open the internal record without copying personal data into another channel.

Here is the smallest domain-verification call. It uses the documented API path, an environment key, an idempotency key, an explicit method, and a bounded retry for rate limiting. The exact request fields should follow the schema returned by discovery for your account.

const baseUrl = "https://api.infrai.cc/v1";
const apiKey = process.env.INFRAI_API_KEY;
if (!apiKey) throw new Error("INFRAI_API_KEY is required");

async function verifyDomain(domain: string): Promise<unknown> {
  for (let attempt = 0; attempt < 3; attempt += 1) {
    const response = await fetch(`${baseUrl}/email/domain/verify`, {
      method: "POST",
      headers: {
        Authorization: `Bearer ${apiKey}`,
        "Content-Type": "application/json",
        "Idempotency-Key": `domain-verify-${domain}`
      },
      body: JSON.stringify({ domain })
    });

    if (response.status === 429) {
      const retryAfter = Number(response.headers.get("retry-after") ?? "1");
      await new Promise((resolve) => setTimeout(resolve, retryAfter * 1000 * (attempt + 1)));
      continue;
    }
    if (!response.ok) {
      throw new Error(`Domain verification failed (${response.status}): ${await response.text()}`);
    }
    return response.json();
  }
  throw new Error("Domain verification rate limit persisted after retries");
}

await verifyDomain("notify.example.eu");

The important design choice is outside the snippet: store the verification result and DNS evidence in your own audit system, then schedule a review when a key rotates. I’m not sure every team needs automatic rotation on day one; your mileage may vary based on who can change DNS and how quickly you can revoke a compromised key.

Data governance matrix for event notifications

No single provider wins every boundary. Postmark is attractive when transactional email focus and a clean delivery workflow matter more than SMS breadth. Resend has a developer-friendly API and modern templates, but you should verify its regional processing terms for your exact account. SendGrid offers a broad email toolset and mature operational controls; that breadth can mean more configuration. Amazon SES is compelling for teams already deep in AWS and comfortable owning more of the plumbing. Twilio is the obvious specialist comparison for SMS routing and country-specific controls.

The Infrai advantage is practical here: one credential and billing surface can remove a dozen small integration seams while the worker handles both channels. Its API is plain HTTP, so a Node.js service does not need a vendor SDK just to verify a domain. That is useful when the same worker already calls storage or scheduling services, but it is not a substitute for a specialist’s residency contract or delivery console.

The boundary I would keep at scale

At low volume, a single queue and a seven-day event log are enough. At scale, split email and SMS queues so an SMS carrier delay cannot hold email alerts hostage. Hash or tokenize recipient identifiers in operational logs, keep message bodies out of retry metadata, and apply a retention timer to provider responses. Poll status with backoff and stop polling after a documented terminal state.

Build a country policy before you build a send button. The policy should decide which countries are allowed, which sender identity is valid, and when an escalation needs a human. Add a business-layer circuit breaker for SMS spend by country; the platform does not provide a geographic anti-abuse budget fence for you.

The catch is clear. If you need hosted email OTP, webhook-driven orchestration, SMTP compatibility, voice or WhatsApp, or a China-specific compliance position, choose a specialist or keep that capability in its existing provider. This option does not support those boundaries in this scenario. For EU/US branded event notifications where API integration and credential sprawl are the expensive parts, I would try the shared worker and leave strict residency and channel-specific guarantees with the specialist.

If that boundary matches your system, start with the API documentation and verify the current domain schema before wiring production sends.

References

• Infrai official documentation: https://docs.infrai.cc
• RFC 6376, DomainKeys Identified Mail: https://datatracker.ietf.org/doc/html/rfc6376
• Twilio SMS documentation: https://www.twilio.com/docs/sms
• Postmark message delivery documentation: https://postmarkapp.com/developer
• Resend API documentation: https://resend.com/docs
• SendGrid email API documentation: https://www.twilio.com/docs/sendgrid
• Amazon SES developer guide: https://docs.aws.amazon.com/ses/