How does a small independent website set up limited email sending capability?

Question

I run a website which needs to send the following emails:

• Sign-up email confirmation (required for access)
• Forgot password requests
• Change email address requests
• 2-factor enrollment requests
• Payment receipts

Previously, I simply had exim4 installed on the VPS and was sending email directly from there. However, in recent times, those emails were getting rejected by several large email providers (Microsoft and Yahoo) due to spam coming from adjacent IP address space.

Since I use Fastmail for the human emails originating from that domain, I configured the web application to use Fastmail SMTP credentials for sending those emails using my account there. That's been working great, until today, when I received an abuse report from Fastmail. They tell me that people have been marking the "Welcome to [website], please confirm your email address" as spam, and that I am not (no longer?) allowed to send automated email using their service.

So how does a small and low-budget website send (very small quantities of) email these days?

Answer 1

Are you sure that Fastmail said it was in relation to sign up emails? It is very unusual that they would have any visibility of this, letalone reported it back to you. It is far more likely that there is a vulnerability in your application someone is exploiting. You should be logging details of every email your application sends (if not then please do so). Go start analysing those logs and checking for vulnerabilties.

Your app should be monitoring your signup process for signs of abuse - applying automatic bans to IP addresses which attempt multiple registrations in a short time window.