🪴 Nishanth Gobi

Custom domain email without paying for Google Workspace

4 min read

The setup I used to get [email protected] sending and receiving cleanly, for free, through Gmail. Inbound goes through Cloudflare Email Routing. Outbound goes through Resend’s SMTP relay, plugged into Gmail’s “Send mail as.” No Google Workspace required.

The architecture

Two separate paths, one for each direction. Most setup guides treat email as one thing — it isn’t. Receiving mail and sending mail use different DNS records, different services, and different verification mechanisms.

INBOUND
sender → MX records on nishanthgobi.com → Cloudflare Email Routing → forwards to [email protected]

OUTBOUND  
Gmail compose (from: [email protected]) → Resend SMTP relay → recipient's inbox

Why split? Cloudflare Email Routing is receive-only - it has no SMTP server you can authenticate against to send. Resend gives real outbound SMTP. Together they’re free; separately neither is enough.

What I had to set up

1. Cloudflare Email Routing (inbound)

Cloudflare dashboard → domain → Email → Email Routing → Enable.

  • Add destination email (Gmail) and verify via the link Cloudflare sends.
  • Create a specific route: [email protected] → forward to Gmail.
  • Create a catch-all route: anything else @nishanthgobi.com → forward to Gmail.
  • Cloudflare auto-adds the MX records.

The catch-all is the underrated piece. Lets me sign up for any service with a unique address (netflix@, github@, nyt@) without configuring each one. If one leaks I know which service leaked it, and I can block just that address.

2. Resend (outbound)

Sign up at resend.com (free tier: 100/day, 3000/month).

  • Add nishanthgobi.com as a domain.
  • Add the DNS records Resend provides. Three categories:
    • DKIM: TXT record at resend._domainkey — cryptographic signing key.
    • SPF: TXT and MX records at send subdomain — authorizes Resend to send for your domain.
    • DMARC: TXT record at _dmarc with v=DMARC1; p=none; — permissive policy while sending reputation builds.
  • Wait for verification (5–30 min after DNS propagates). All three should show “Verified.”
  • Generate an API key: dashboard → API Keys → Create. Copy immediately, it’s shown only once.

Important: leave Resend’s “Enable Receiving” off. Inbound is Cloudflare’s job. Two services trying to handle inbound for the same domain conflict.

3. Gmail “Send mail as”

Gmail → Settings → Accounts and Import → Send mail as → Add another email address.

  • Name: Nishanth Gobi
  • Email: [email protected]
  • Treat as alias: âś“ (Google’s recommended default)
  • Click Next.

SMTP screen:

SMTP Server: smtp.resend.com
Port:        587
Username:    resend
Password:    <Resend API key>
Encryption:  TLS

Gmail sends a verification code to [email protected]. Cloudflare forwards it to Gmail. Open, paste code, done.

Last setting on the same Accounts page: “When replying to a message: Reply from the same address the message was sent to.” Without this, replies go out from your Gmail address and confuse recipients.

Test it end-to-end

Round-trip from a third-party inbox (Outlook, Apple, ProtonMail — not Gmail, because Gmail-to-Gmail hides certain auth issues):

  1. Send to [email protected] from the test inbox → should land in Gmail in seconds.
  2. Reply from Gmail. Sender should show as [email protected], not “on behalf of.”
  3. Compose a fresh email from Gmail with [email protected] selected as From, send to test inbox. Same check — clean From header.

If “on behalf of” shows up, DKIM alignment is off. Most likely cause: DMARC alignment misconfigured. Worth fixing because some recipients (Outlook especially) flag this visibly.

Resend free tier limits and when they bite

  • 100 emails/day, 3000/month — easily fits any personal correspondence forever.
  • The cap matters when products start emailing. Each waitlist confirmation, password reset, notification digest is one email. A newsletter to 1000 subscribers Ă— weekly = 4000/month, already over.
  • Pro tier (~$20/month for 50,000) is the next meaningful step. Easy upgrade when needed.

Things to plan for:

  • Sending reputation lives on the domain. Don’t blast unsolicited mail. Reputation takes months to build, days to destroy.
  • Multiple domains can sit on the same Resend account (free tier limits how many; Pro lifts this). Keeping product domains separate from nishanthgobi.com protects personal reputation.
  • DMARC policy starts at p=none (monitor only). After 30–60 days of clean sending, tighten to p=quarantine, then p=reject. Protects against domain spoofing.

When to abandon this and pay for Workspace

Triggers to switch to Google Workspace ($6/month per user):

  • Want a real Gmail mailbox at [email protected] (instead of forwarding to a separate Gmail).
  • Want shared Calendar / Drive / Docs under nishanthgobi.com.
  • Building a team and need multiple branded inboxes.
  • Want admin controls and audit logs.

Until any of these are true, the Cloudflare + Resend + Gmail-Send-As setup is functionally equivalent and free.

Useful references

  • Keeping AWS clean — same principle, different tool: infrastructure should be reproducible and not rely on tribal knowledge.

Graph View