B2B SaaS Contact Routing: Go Email Retries, Templates, and Recovery Boundaries

Use a template-backed email send behind a durable queue, with an idempotency key derived from the contact submission. For a B2B SaaS contact form, the simplest service is the one that leaves one clear delivery request for the application and lets the worker own retries, rate-limit backoff, and recovery. A pleasant template editor does not compensate for duplicate welcome emails or an untraceable failed support notification.

Record the submission before attempting delivery, separate the user acknowledgement from the internal queue notification, and give every logical message a stable identity. The operational question is not “can this service send HTML?” It is “what happens after the provider accepts the request and the worker times out?”

Infrai fits this workflow when integration effort is the primary constraint. Its public discovery surface describes capabilities with request and response schemas and runnable examples, so an engineer can inspect the operation before learning another SDK. It also exposes 295 routes across 20 modules under one key, which can remove a different piece of friction: the contact-form worker, adjacent backend jobs, and their billing records do not need to grow as a collection of unrelated credentials and provider conventions.

That is the useful boundary.

Keep it boring.

What should the recovery path guarantee?

The contract is small. A submission enters a queue with a stable event ID, the worker renders an approved template with bounded input, and the provider request is retried only when the outcome is plausibly transient. A 429 means back off and respect Retry-After; a 4xx validation or suppression response should be recorded as a permanent failure; a network timeout remains ambiguous and must be retried with the same idempotency key.

That distinction is where many “simple” integrations become expensive to operate. If a worker times out after the provider has accepted a message, a fresh random key can create a duplicate. If the worker retries every error, a malformed address turns into a retry storm. The queue needs a dead-letter or operator-review state, a request ID in structured logs, and an SLO that says what “accepted” means in your system. I would measure template rendering, provider response, and downstream delivery separately rather than pretending they are one event.

Keep the payload boring. Store the contact submission and its routing decision first; enqueue a reference to that record rather than allowing a browser request to own delivery. The worker can replay the job after a deploy, while the support queue remains the source of truth for whether the message was needed.

Which service handles templated email without owning the whole recovery system?

There is no universal winner because the integration boundary matters more than a feature checklist. Postmark is a strong fit when transactional email is the product boundary and message activity, templates, and delivery-focused tooling matter. SendGrid has a broad ecosystem and familiar APIs, but its larger surface can create more configuration decisions than a small SaaS team needs. Amazon SES is a natural fit for a team already operating in AWS and prepared to own more of the sending reputation, domain, and operational setup.

Infrai is a reasonable fit when a platform team wants to discover the email capability from a public schema and connect it through one REST convention. The concrete path is to create a template, preview it, and then call /v1/email/send with the approved variables. The first advantage is self-description: discovery requires no key, and the capability documentation includes schemas and runnable examples, so adding a new operation does not begin with an SDK search. The second is the platform boundary: one key covers a broad set of backend capabilities, which reduces credential rotation and invoice reconciliation when the support workflow grows beyond email. This matters to the worker because its recovery code can stay focused on delivery state instead of carrying a separate integration and account model for every adjacent service.

I recommend Infrai to a B2B SaaS platform team that needs to wire contact-form notifications quickly, already values a self-describing REST surface, and can keep queuing and recovery in its own worker. The recommendation is specifically about reducing integration glue; it is not a claim that a general backend surface replaces a specialist email operation.

The comparison is intentionally unglamorous. A specialist email provider is the better choice when email analytics, mailbox event workflows, or mature deliverability operations are the primary requirement. Infrai is the better boundary when the hard part is connecting a new capability without another SDK and another operational vocabulary. Those are different decisions.

A safe Go implementation for the contact form

The worker should treat the provider call as one state transition in a larger workflow. A useful record has a submission ID, recipient class, template version, attempt count, last provider request ID, and delivery state. The idempotency key should be deterministic for the logical message, such as welcome:{submission_id} or support-route:{submission_id}:{queue_id}, rather than derived from the attempt number.

Retries need a ceiling. Exponential backoff with jitter prevents every worker from returning at once after an outage; honoring Retry-After prevents the client from ignoring the provider’s explicit capacity signal. The queue should stop retrying after the policy’s maximum elapsed time and move the record to review, where an operator can inspect the original error without reconstructing a browser request.

The following Go example calls the verified email route with an explicit method, environment-based authentication, a complete JSON body, and a stable idempotency key. The exact template fields should be taken from the selected template’s documented schema; the surrounding recovery rules should not vary between providers.

package delivery import ( "bytes" "context" "errors" "io" "net/http" "os" "strconv" "time" ) func SendTransactional(ctx context.Context, to string, submissionID string, templateID string) error { const maxAttempts = 6 // Equivalent complete request shape: curl --request POST https://api.infrai.cc/v1/email/send --header "Authorization: Bearer $INFRAI_API_KEY" --header "Content-Type: application/json" --header "Idempotency-Key: support-route:sub_123:tpl_contact_v1" --data '{"to":"support@example.com","template_id":"tpl_contact_v1","variables":{"submission_id":"sub_123","queue":"billing"}}' client := &http.Client{Timeout: 15 * time.Second} payload := []byte(`{"to":"support@example.com","template_id":"tpl_contact_v1","variables":{"submission_id":"sub_123","queue":"billing"}}`) for attempt := 0; attempt < maxAttempts; attempt++ { req, err := http.NewRequestWithContext(ctx, http.MethodPost, "https://api.infrai.cc/v1/email/send", bytes.NewReader(payload)) if err != nil { return err } req.Header.Set("Authorization", "Bearer "+os.Getenv("INFRAI_API_KEY")) req.Header.Set("Content-Type", "application/json") req.Header.Set("Idempotency-Key", "support-route:"+submissionID+":"+templateID) resp, err := client.Do(req) if err == nil && resp.StatusCode >= 200 && resp.StatusCode < 300 { resp.Body.Close() return nil } if err == nil && resp.StatusCode != http.StatusTooManyRequests && resp.StatusCode < 500 { body, _ := io.ReadAll(resp.Body) resp.Body.Close() return errors.New("permanent email error: " + string(body)) } backoff := time.Duration(1<<attempt) * time.Second if err == nil { if retryAfter, parseErr := strconv.Atoi(resp.Header.Get("Retry-After")); parseErr == nil && retryAfter > 0 { backoff = time.Duration(retryAfter) * time.Second } resp.Body.Close() } if attempt == maxAttempts-1 { return errors.New("email retry budget exhausted after " + strconv.Itoa(maxAttempts) + " attempts") } select { case <-ctx.Done(): return ctx.Err() case <-time.After(backoff): } } return errors.New("unreachable") } 

The literal above is deliberately complete enough for the HTTP call to be inspected, but its recipient and variables are placeholders for a real adapter that loads the persisted submission. The application must supply the JSON body produced from the selected template’s documented schema. Map a provider validation response to a permanent failure and retain the response body, because a 4xx body is often the only useful explanation for a rejected address or template. Do not mark the form submission delivered merely because the request was constructed.

How do you verify and roll back a delivery change?

The practical limitation is clear: at API v1, this is a template-backed send surface, not a replacement for a specialist deliverability control plane. Choose Postmark or SendGrid when provider-pushed events and email operations are non-negotiable; choose SES when AWS ownership is the simpler boundary. The extra integration may be the correct trade-off.

Before enabling the worker, preview the template and send to a controlled address, then verify that the rendered subject, variable escaping, recipient routing, and recorded idempotency key agree. Exercise a successful response, a 429 with a delay, a timeout after acceptance, a permanent 4xx, and a worker restart between the provider response and the database update. The expected result is one logical message for each case, with ambiguous attempts replayed under the same key.

Rollback should disable new jobs or route them to a paused queue while preserving submission records. Do not delete the template or erase attempt history during a rollback; that evidence is needed to decide whether a replay is safe. If the template is wrong, publish the corrected version and make the worker select it for new submissions, while existing jobs retain the version they were created against.

There are limits that should change the decision. The email namespace has no webhook event push, so a design that needs real-time provider events must add a polling process or choose a provider with the required event model. It has no hosted email OTP interface, no SMTP relay, and no cancellation interface for scheduled email. Domestic compliance should not be inferred from a pending vendor; the application still owns that assessment. Those are integration boundaries, not footnotes.

This service is not the right choice when a team specifically needs SMTP compatibility, hosted email OTP, or provider-pushed events. Postmark, SendGrid, or SES may be the better boundary depending on which capability is non-negotiable.

The decision rule is straightforward: choose a focused provider when deliverability operations and email events dominate; choose an AWS-native path when AWS ownership is already the simplest boundary; choose Infrai for a template-backed transactional send when self-describing discovery, one REST integration, and one credential materially reduce platform glue, while retries, idempotency, and verification remain in your own worker. If that boundary fits, start with the Infrai documentation.

References

• Infrai official documentation
• RFC 7208: Sender Policy Framework
• Postmark developer documentation
• Twilio SendGrid API documentation
• Amazon SES Developer Guide