Outbound Custom SMTP over Raw Edge Sockets: Ditching Nodemailer on Cloudflare Workers.

The problem: Why multi-tenant SMTP breaks serverless

When building modern web applications, outbound transactional email is usually trivial: you grab an API key from Resend, Postmark, or SendGrid, call fetch('https://api.resend.com/emails', ...), and call it a day.

That model completely collapses the moment you build a multi-tenant communication platform (such as the unified inbox and CRM we run at hub.chandandubey.com). In enterprise software:

• Customers insist on their own mail infrastructure: They do not want their business emails originating from your shared IP pool or signed with your DKIM selector. They provide their own SMTP host, port (465 or 587), and credentials for Google Workspace, Microsoft 365, Zoho Mail, Amazon SES, or private Postfix.
• Nodemailer fails on Edge Isolates: nodemailer is built on Node's native net.Socket, tls.TLSSocket, and stream internals. Even with modern nodejs_compat flags enabled, Nodemailer fails to negotiate raw socket transitions and STARTTLS handshakes inside V8 isolates.
• The dreaded "relay container" tax: The conventional industry workaround is spinning up a separate Node.js microservice on Railway, Render, or AWS EC2 purely to run Nodemailer as an internal HTTP-to-SMTP proxy. That introduces network hops, container cold starts, extra failure domains, and ongoing server costs.

We wanted something better: when a user clicks "Send" or runs a connection test, our Cloudflare Worker should open a raw TCP socket directly to smtp.gmail.com:587 or mail.company.com:465, execute the full cryptographic handshake, transmit the payload, and close the socket in under 250 milliseconds.

The primitives: Entering cloudflare:sockets

Cloudflare provides the low-level cloudflare:sockets API, which exposes direct TCP socket creation via connect():

import { connect } from "cloudflare:sockets";

const socket = connect(
  { hostname: "smtp.mailprovider.com", port: 587 },
  { secureTransport: "off" } // or "on" for SSL port 465
);

While connect() gives you raw access to bytes, it is not an SMTP client. You get a ReadableStream<Uint8Array> and a WritableStream<Uint8Array>. To send an email, you have to write a fully compliant RFC 5321 and RFC 5322 protocol engine from scratch.

Here are the five critical protocol gotchas we had to crack that standard documentation never tells you.

Gotcha #1: Stream chunking vs line-delimited SMTP

SMTP is a line-delimited ASCII protocol terminating on \r\n (CRLF). However, TCP is a streaming byte protocol. When the remote mail server responds with a greeting like 220 smtp.domain.com ESMTP, the TCP packets can arrive fragmented across arbitrary chunks. A single line may be split into two chunks, or three lines may be bundled into a single 512-byte read.

If you try to process chunks naively, your protocol parser breaks under packet jitter. We built a streaming reader with a TextDecoder that buffers chunks until a true CRLF delimiter is reached:

export class SmtpStreamReader {
  private buffer = "";
  private reader: ReadableStreamDefaultReader<Uint8Array>;
  private decoder = new TextDecoder();

  constructor(stream: ReadableStream<Uint8Array>) {
    this.reader = stream.getReader();
  }

  async readLine(timeoutMs = 15000): Promise<string> {
    const start = Date.now();
    while (!this.buffer.includes("\r\n")) {
      if (Date.now() - start > timeoutMs) {
        throw new Error("SMTP connection timed out waiting for server response");
      }
      const { value, done } = await this.reader.read();
      if (done) break;
      this.buffer += this.decoder.decode(value, { stream: true });
    }
    const idx = this.buffer.indexOf("\r\n");
    if (idx === -1) {
      const remaining = this.buffer;
      this.buffer = "";
      return remaining;
    }
    const line = this.buffer.slice(0, idx);
    this.buffer = this.buffer.slice(idx + 2);
    return line;
  }
}

Gotcha #2: The multi-line response trap (250- vs 250 )

When you send EHLO to negotiate server capabilities, an SMTP server almost never responds with a single line. It sends a multi-line list of supported extensions (PIPELINING, SIZE, 8BITMIME, STARTTLS, AUTH).

According to RFC 5321 §4.2, an SMTP server indicates that more lines are coming by placing a hyphen (-) immediately after the status code, and a space () only on the final line:

250-smtp.google.com at your service
250-SIZE 35882577
250-8BITMIME
250-STARTTLS
250-ENHANCEDSTATUSCODES
250 CHUNKING <-- Notice the space! This indicates completion.

If your client reads only the first line and immediately issues the next command (like STARTTLS or AUTH LOGIN), the remaining 250 lines are left sitting in the TCP buffer. Your entire command-response state becomes desynchronized, causing subsequent commands to fail with syntax errors.

Our response parser explicitly monitors the 4th character of every line to ensure complete consumption:

async readResponse(timeoutMs = 15000): Promise<{ code: number; message: string; lines: string[] }> {
  const lines: string[] = [];
  let code = 0;
  while (true) {
    const line = await this.readLine(timeoutMs);
    if (!line) {
      if (lines.length === 0) throw new Error("Connection closed unexpectedly by SMTP server");
      break;
    }
    lines.push(line);
    const match = /^(\d{3})([ -])(.*)$/.exec(line);
    if (match) {
      code = parseInt(match[1]!, 10);
      if (match[2] === " ") {
        break; // final line of response!
      }
    } else {
      break;
    }
  }
  return { code, message: lines.join("\n"), lines };
}

Gotcha #3: In-flight STARTTLS upgrades on port 587

There are two primary ways SMTP handles encryption:

• Port 465 (Implicit TLS): The socket establishes a TLS session immediately upon connection (secureTransport: "on").
• Port 587 (Explicit TLS / Submission): The initial connection starts in cleartext. You issue EHLO, request STARTTLS, receive 220 Ready to start TLS, and then upgrade the active TCP stream to TLS.

In Cloudflare Workers, calling socket.startTls() while reader or writer streams are locked will immediately throw an uncatchable runtime error: TypeError: Cannot upgrade locked stream.

To upgrade cleanly, you must release all reader and writer stream locks, call startTls() to obtain the upgraded socket instance, rebuild new streaming readers/writers on top of the TLS streams, and re-issue EHLO to refresh advertised capabilities:

// STARTTLS transition on Port 587
if (!isSecure && config.port === 587 && socket.startTls) {
  await sendCommand(writer, reader, "STARTTLS", [220]);
  
  // 1. Release active stream locks
  reader.release();
  writer.releaseLock();

  // 2. Perform in-flight TLS handshake
  socket = socket.startTls();
  
  // 3. Re-bind streams to TLS socket
  reader = new SmtpStreamReader(socket.readable);
  writer = socket.writable.getWriter();

  // 4. Re-issue EHLO over encrypted transport
  await sendCommand(writer, reader, "EHLO hub.chandandubey.com", [250]);
}

Gotcha #4: Stepwise AUTH LOGIN challenge-response

While modern HTTP APIs use bearer tokens, enterprise SMTP servers overwhelmingly utilize AUTH LOGIN. AUTH LOGIN is an interactive challenge-response exchange where the server sends base64 prompts (334 VXNlcm5hbWU6 for "Username:" and 334 UGFzc3dvcmQ6 for "Password:").

Our engine implements this two-step verification using native btoa() encoding:

if (config.username && config.password) {
  await writeString(writer, "AUTH LOGIN\r\n");
  const authRes = await reader.readResponse();
  if (authRes.code !== 334) throw new Error(`AUTH LOGIN rejected: ${authRes.message}`);

  // Challenge 1: Username
  await writeString(writer, btoa(config.username) + "\r\n");
  const userRes = await reader.readResponse();
  if (userRes.code !== 334) throw new Error(`Username rejected: ${userRes.message}`);

  // Challenge 2: Password
  await writeString(writer, btoa(config.password) + "\r\n");
  const passRes = await reader.readResponse();
  if (passRes.code !== 235) throw new Error(`Authentication failed: ${passRes.message}`);
}

Gotcha #5: RFC 5321 §4.5.2 "Dot-Stuffing"

In SMTP, the end of the email body transmission during the DATA phase is signaled by a single period on a line by itself: \r\n.\r\n.

What happens if your email contains a code snippet, markdown bullet, or sentence that begins with a dot (for example, .env or .gitignore)?

Without proper handling, the remote SMTP server assumes the message has ended prematurely, cuts off the rest of the body, and throws syntax errors on the remaining data. RFC 5321 §4.5.2 specifies the solution: Transparency (Dot-Stuffing). Any line in the message body starting with a period must be escaped by prepending an additional period (..):

// Dot-stuffing per RFC 5321 §4.5.2
const stuffedBody = body.replace(/\r?\n\./g, "\r\n..");
const fullPayload = `${headers.join("\r\n")}\r\n\r\n${stuffedBody}\r\n.\r\n`;

await writeString(writer, fullPayload);
const dataRes = await reader.readResponse();
if (dataRes.code !== 250) {
  throw new Error(`DATA delivery failed [${dataRes.code}]: ${dataRes.message}`);
}

The complete send pipeline: From Edge isolate to inbox

When we tie all these pieces together, the entire outbound dispatch process—from opening the socket, performing TLS negotiation, authenticating, delivering MIME headers, dot-stuffing the body, and cleanly issuing QUIT—runs directly inside the Cloudflare Worker isolate in an average of 180ms to 320ms:

export async function sendSmtpEmail(
  config: SmtpConfig,
  options: SmtpSendOptions,
  socketFactory: SocketFactory = defaultSocketFactory,
): Promise<SmtpResult> {
  const isSecure = config.secure ?? config.port === 465;
  const socket = await socketFactory(
    { hostname: config.host, port: config.port },
    { secureTransport: isSecure ? "on" : "off" },
  );

  let reader = new SmtpStreamReader(socket.readable);
  let writer = socket.writable.getWriter();

  try {
    // 1. Initial Greeting (220)
    await reader.readResponse();

    // 2. Initial EHLO
    await sendCommand(writer, reader, "EHLO hub.chandandubey.com", [250]);

    // 3. In-flight STARTTLS upgrade if port 587
    if (!isSecure && config.port === 587 && socket.startTls) {
      await sendCommand(writer, reader, "STARTTLS", [220]);
      reader.release();
      writer.releaseLock();
      socket = socket.startTls();
      reader = new SmtpStreamReader(socket.readable);
      writer = socket.writable.getWriter();
      await sendCommand(writer, reader, "EHLO hub.chandandubey.com", [250]);
    }

    // 4. Authenticate
    if (config.username && config.password) {
      await writeString(writer, "AUTH LOGIN\r\n");
      await reader.readResponse();
      await writeString(writer, btoa(config.username) + "\r\n");
      await reader.readResponse();
      await writeString(writer, btoa(config.password) + "\r\n");
      await reader.readResponse();
    }

    // 5. Envelope Routing
    await sendCommand(writer, reader, `MAIL FROM:<${extractEmailAddress(options.from)}>`, [250]);
    for (const to of options.to.map(extractEmailAddress)) {
      await sendCommand(writer, reader, `RCPT TO:<${to}>`, [250, 251]);
    }

    // 6. Data payload transmission
    await sendCommand(writer, reader, "DATA", [354]);
    const messageId = options.messageId || `<msg_${newId()}@hub.chandandubey.com>`;
    const fullPayload = buildRfc5322Payload(options, messageId);
    await writeString(writer, fullPayload);
    await reader.readResponse();

    // 7. Clean termination
    await writeString(writer, "QUIT\r\n");
    await reader.readResponse().catch(() => {});

    return { ok: true, messageId };
  } finally {
    reader.release();
    try { writer.releaseLock(); } catch {}
    if (socket.close) void socket.close();
  }
}

Real-world results: Architecture & economics

By implementing this zero-dependency SMTP client directly on edge sockets, we gained massive engineering and financial advantages across our production stack:

Key engineering takeaways

If you are building modern edge applications or multi-tenant SaaS platforms:

• Stop paying the "relay server" tax: You do not need to run an external container or pay an API middleman just to dispatch email to a customer's custom SMTP host. TCP sockets at the edge are mature, robust, and lightning fast.
• Respect RFC protocol boundaries: Edge isolates are unforgiving. You must respect line buffering, multi-line status delimiters (250- vs 250 ), and dot-stuffing (RFC 5321 §4.5.2) to avoid silent data truncation.
• Release stream locks before upgrading: When performing in-flight STARTTLS transitions with cloudflare:sockets, always release your stream locks prior to invoking socket.startTls().

This engine is currently running in production powering custom SMTP channels, live connection verification, and conversation dispatch for hub.chandandubey.com.