web/mail/README.md

Transactional mail transport

mail.Message is one bounded UTF-8 plain-text message with a stable ID/date and one ASCII envelope recipient. NewSMTP binds a fixed, configured sender and dedicated SMTP credentials. Use implicit TLS (normally465) or required STARTTLS (normally587). Certificate chain and hostname verification are mandatory; no plaintext fallback or caller-provided arbitrary headers/attachments exist.

The standard-library transport uses a bounded connection deadline and cancellation across TLS and SMTP. Message IDs survive retries. Errors expose only a fixed stage, numeric SMTP code and retry classification; raw server responses are not propagated because they can contain addresses or credentials. Successful DATA acceptance is success even if QUIT fails. A connection failure around acceptance can still produce duplicate delivery on retry: SMTP is not exactly-once transport, and acceptance is not proof of inbox placement.

Applications own authorized recipients, email templates, trusted HTTPS link origins, rate limits, encrypted persistence and the worker. Never log message content or serialize credentials into ordinary diagnostics. Debug string methods redact sensitive content but are not a substitute for safe logging policy. No account verification/reset protocol is implemented by this transport itself.

Verified locally with disposable SMTP servers: implicit/STARTTLS delivery, certificate/hostname rejection, no-downgrade behavior, auth/recipient error classification, cancellation after connection, MIME round-trip, injection/bounds and acceptance followed by QUIT failure. go test -race ./mail and go vet ./mail pass on Go1.26.6. No real credentials, message delivery, public package release or consumer deployment are claimed. The encrypted outbox adds transactional persistence; authmail supplies optional account protocols with consumer-owned forms and authorization boundaries.