Email & Notifications

const nodemailer = require('nodemailer');

const transporter = nodemailer.createTransport({
  host: 'smtp.sendgrid.net',
  port: 587,
  auth: { user: 'apikey', pass: process.env.SENDGRID_API_KEY },
});

await transporter.sendMail({
  from: 'noreply@example.com',
  to: user.email,
  subject: 'Welcome!',
  html: '<h1>Welcome to our platform</h1>',
});

Common follow-ups: Why do most production applications use a third-party email provider (SendGrid, SES) rather than sending directly from their own server via SMTP?;How would you handle and log a failed email send without blocking the request that triggered it?

// Blocking: the user waits for the email to send before getting a response
app.post('/register', async (req, res) => {
  const user = await createUser(req.body);
  await sendWelcomeEmail(user); // slow, and a failure here fails the whole request
  res.json(user);
});

// Better: enqueue and respond immediately
app.post('/register', async (req, res) => {
  const user = await createUser(req.body);
  await emailQueue.add('welcome-email', { userId: user.id });
  res.json(user);
});

Common follow-ups: How would you notify a user if their welcome email ultimately fails after all configured retries?;What's the tradeoff of this asynchronous approach for genuinely time-sensitive emails, like a login verification code?

; Example SPF DNS TXT record
v=spf1 include:sendgrid.net ~all

; Example DMARC DNS TXT record
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

Common follow-ups: How does DKIM signing actually work cryptographically to verify a message wasn't tampered with?;What's the difference between DMARC's 'none', 'quarantine', and 'reject' policy modes?

const admin = require('firebase-admin');
admin.initializeApp({ credential: admin.credential.cert(serviceAccount) });

await admin.messaging().send({
  token: userDeviceToken,
  notification: { title: 'Order Shipped', body: 'Your order is on its way!' },
});

Common follow-ups: How do you handle an invalid or expired device token returned by FCM when sending a notification?;What's the difference between targeting a specific device token versus a topic subscription for broadcast notifications?

class NotificationService {
  constructor(channels) { this.channels = channels; } // { email: EmailChannel, sms: SmsChannel }
  async notify(user, event) {
    const preferredChannels = user.notificationPreferences; // e.g., ['email', 'push']
    await Promise.allSettled(
      preferredChannels.map(ch => this.channels[ch].send(user, event))
    );
  }
}

Common follow-ups: How does this design apply the Strategy or Adapter pattern discussed earlier in Architecture & Design Patterns?;How would you track and avoid sending duplicate notifications for the same event across multiple channels?

const mjml2html = require('mjml');
const Handlebars = require('handlebars');

const template = Handlebars.compile(mjmlSource);
const filledMjml = template({ userName: user.name, orderTotal: order.total });
const { html } = mjml2html(filledMjml);

await transporter.sendMail({ to: user.email, subject: 'Order Confirmation', html });

Common follow-ups: Why is writing HTML email templates significantly more constrained than writing regular web HTML/CSS?;How would you preview a rendered email template across different email clients before sending it to real users?

async function canSendNotification(userId, maxPerHour = 5) {
  const key = `notif-rate:${userId}`;
  const count = await redis.incr(key);
  if (count === 1) await redis.expire(key, 3600);
  return count <= maxPerHour;
}

Common follow-ups: How do you decide an appropriate per-user rate limit without being so restrictive that important notifications get suppressed?;How would you prioritize which notifications to send first if a user has hit their rate limit and several are queued?

// Transactional: sent from a dedicated subdomain with strict reputation protection
from: 'noreply@transactional.example.com'

// Marketing: sent from a separate subdomain, isolating reputation impact
from: 'newsletter@marketing.example.com'

Common follow-ups: What compliance requirements (like CAN-SPAM or GDPR) specifically apply to marketing email that don't apply the same way to transactional email?;How do email providers like SendGrid support separating these two categories at the account or subdomain level?

app.post('/webhooks/sendgrid', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifySendGridSignature(req)) return res.status(401).end();
  const events = JSON.parse(req.body);
  for (const event of events) {
    if (event.event === 'bounce') suppressList.add(event.email);
  }
  res.status(200).end(); // acknowledge quickly
});

Common follow-ups: Why is verifying the webhook's signature critical before trusting and acting on its payload?;What's the risk of doing heavy processing synchronously inside the webhook handler itself rather than deferring it to a queue?

app.get('/unsubscribe', async (req, res) => {
  const { token } = req.query;
  const userId = await verifyUnsubscribeToken(token);
  await updateUserPreferences(userId, { marketingEmailsEnabled: false });
  res.send('You have been unsubscribed successfully.');
});

Common follow-ups: Why should an unsubscribe link use a signed token rather than just a plain email address in the URL?;Does an unsubscribe request need to also apply to transactional emails, or only marketing emails?