Scaleway Transactional Email for Laravel, compared

Every Laravel app sends mail: a password reset, an invoice, a sign-in link. That mail carries names, addresses and often the content of an order, which makes the mail provider one of the outside services that sees the most personal data. Scaleway, where many European Laravel apps already run, has its own service for it: Transactional Email, or TEM.

This post explains what TEM does, how a Laravel app sends through it, and how it compares with two common alternatives: Lettermint, a Dutch transactional mail service, and Amazon SES. Prices are list prices at the time of writing; check the providers' own pages before you decide.

What is Scaleway Transactional Email?#

Scaleway Transactional Email sends mail from your own, verified domain, over SMTP or an HTTP API. It runs in the Paris region only, and Scaleway stores and processes its data in France. It is meant for mail your app sends one by one, such as password resets and order confirmations, not for newsletters to a bought list.

What it does:

• Sends from a domain you add to a Scaleway project, once its DNS records check out.
• Reports per domain whether SPF, DKIM, DMARC and MX are in order, and gives the domain a reputation score.
• Blocks recipients that bounce hard, through an automatic blocklist.
• Tells you what happened to each email (delivered, deferred, dropped, marked as spam, mailbox not found) through webhooks that publish to a Scaleway Topics and Events topic.

What it does not do: receive mail. TEM has no inbox. Replies to your mail go wherever the MX record of your domain points.

How a Laravel app sends through TEM#

Laravel's built-in smtp mailer is enough. TEM asks for an encrypted connection; port 587 uses STARTTLS, port 465 TLS from the first byte. The user name is the ID of your Scaleway project, the password is the secret key of an IAM API key.

MAIL_MAILER=smtp
MAIL_HOST=smtp.tem.scaleway.com
MAIL_PORT=587
MAIL_USERNAME=your-scaleway-project-id
MAIL_PASSWORD=your-iam-secret-key
MAIL_FROM_ADDRESS=hello@example.eu

Give that key as few rights as you can: an IAM application with only the TransactionalEmailEmailFullAccess permission set, on the one project, can send but cannot change your domains. Keep the secret key in a secret store, never in the repository; see secrets without an .env file.

Note

Symfony publishes symfony/scaleway-mailer, a bridge that can also send over TEM's HTTP API. Laravel has no Scaleway driver of its own, so the bridge needs a few lines of Mail::extend() in a service provider. For most apps, plain SMTP is simpler.

Setting up the domain#

TEM only sends from a domain it has checked. Add the domain to your project, then add the records Scaleway gives you:

A domain can have only one SPF record. If yours has one already, for Google Workspace or Microsoft 365 for instance, add the include to that record instead of making a second one. Leave the MX record alone if the domain already receives mail: Scaleway's suggested blackhole MX would swallow it.

When the domain is in Scaleway Domains and DNS, TEM can write the records itself (autoconfiguration). Note that it also writes the blackhole MX, and that it leaves the records in place when you remove the domain.

What TEM costs#

TEM has two plans, chosen per Scaleway project.

Each recipient counts as one email, CC included: one email to three people is three emails. A new project starts with a limit of 10,000 emails a month, which Scaleway raises after a support request once your payment method and identity are verified. New domains are throttled for a while, and a domain with many bounces is locked until you ask Scaleway to lift it.

TEM, Lettermint and Amazon SES side by side#

All three send transactional mail from your own domain over SMTP and an HTTP API. They differ in who owns them, what they charge for, and how much you have to set up around them.

A few differences the table does not show:

• What counts as an email. TEM bills every recipient, CC included, as one email. SES bases its quotas on recipients as well. Sending one email to ten people is ten emails at both.
• Bounces and complaints. Lettermint sends signed webhooks straight to your app, and its Laravel package turns each into a Laravel event. TEM and SES publish events to a topic first (Scaleway Topics and Events, Amazon SNS or EventBridge), which you then subscribe your app to.
• The DNS records. TEM wants an SPF include on your domain, DKIM and DMARC. Lettermint asks for DKIM, a return-path CNAME and DMARC, and needs no SPF include on the domain itself. SES uses three DKIM CNAMEs, with an optional custom MAIL FROM domain.
• Getting started. A new SES account sends only to verified addresses, 200 a day, until you ask for production access in each region. Lettermint reviews each team before it sends to outside addresses. TEM lets you send as soon as the domain checks out, within its first monthly limit.
• Who can reach the data. TEM and Lettermint are European companies. AWS is American, so mail sent through SES is within reach of the US CLOUD Act, whichever region it runs in; see the CLOUD Act and your Laravel app. SES also runs in the AWS European Sovereign Cloud in Germany, with fewer features, but it remains a service of an American-owned company.

Transactional Email with Brewless#

On Brewless, a production environment with a domain gets Transactional Email at its first deploy, in your own Scaleway project. Brewless asks for the Essential offer when the project has none, adds the domain, makes an identity that may only send, and gives the app Laravel's smtp variables. It names the SPF, DKIM and DMARC records the domain needs and writes them after your yes when its zone is one Brewless manages, adding to an SPF record that stands and never touching MX. A copy of every mail is kept in a bucket of your own for a few days, bounces come back to your app as Laravel events, and the console shows every mail with its headers and a preview. A MAIL_MAILER you set yourself, Lettermint for instance, is never replaced. See Mail.

How to choose#

Choose TEM when your app already runs at Scaleway and you want its mail in the same project, on the same bill, with the data in France. For most apps it is the cheapest European option, and the built-in smtp mailer is all Laravel needs. It suits apps that only send.

Choose Lettermint when you want webhooks that reach your app directly, inbound mail, or a Laravel package that handles both. You pay more per email, and you get more around the sending. Brewless sends its own mail through Lettermint.

Choose Amazon SES when the price per email matters more than where the provider is headquartered, or when the rest of your app already lives at AWS. Count on the sandbox, a request per region and some work in SNS or EventBridge before bounces reach your app.

Whichever you pick, scrub what you send: a password reset needs a link, not the whole user record. For other services a Laravel app calls, see European alternatives for the services Laravel calls.