How Email Sending Works in a Node.js Application

Your MERN Blog needs to send emails for several reasons: a welcome email after registration, an email verification link, a password reset link, and optionally a notification when someone comments on a post. In Node.js, the standard library for sending email is Nodemailer — it creates a connection to an email server using SMTP (or other transports) and delivers the message on your behalf. Understanding how email sending works in a MERN application — the flow from your Express code to the recipient’s inbox — is the foundation for building every email feature in this chapter.

How Email Sending Works #

Your Express Application
        │
        ▼
   Nodemailer (Node.js library)
        │  creates SMTP connection
        ▼
Email Service / SMTP Server
  (Gmail, SendGrid, Resend, Mailgun...)
        │  delivers the message
        ▼
Recipient's Email Server (e.g. Outlook, Yahoo)
        │
        ▼
Recipient's Inbox

Key concepts:
  SMTP         — Simple Mail Transfer Protocol, the standard protocol
                  for sending email between servers
  Transporter  — Nodemailer's connection to an SMTP server,
                  reused across multiple sends
  Transport    — The method of delivery (SMTP, SES, sendmail...)
  Transactional email — triggered by user actions (register, reset password)
                        vs bulk/marketing email (newsletters, announcements)

Types of Emails in the MERN Blog #

What You Need to Send an Email #

// Every email requires these five things:
{
  from:    '"MERN Blog" <noreply@mernblog.com>',  // sender display name + address
  to:      'user@example.com',                      // recipient address
  subject: 'Verify your MERN Blog account',         // subject line
  text:    'Click here to verify: https://...',     // plain text fallback
  html:    '<p>Click here to verify: ...</p>',    // HTML version (preferred)
}

// Emails should always include both text and html — email clients
// that cannot render HTML fall back to the plain text version.

Security Considerations #

Common Mistakes #

Mistake 1 — Blocking the HTTP response while waiting for email to send #

❌ Wrong — user waits for email delivery before getting a response:

const register = asyncHandler(async (req, res) => {
  const user = await User.create({ ... });
  await sendEmail({ to: user.email, ... }); // blocks — slow email servers delay response!
  res.status(201).json({ success: true });
});

✅ Correct — send email after responding, fire-and-forget for non-critical emails:

const register = asyncHandler(async (req, res) => {
  const user = await User.create({ ... });
  res.status(201).json({ success: true }); // respond immediately
  // Send email after — failure does not affect the registration response
  sendEmail({ to: user.email, ... }).catch(err => console.error('Email failed:', err));
});

Mistake 2 — Revealing whether an email is registered during password reset #

❌ Wrong — different response for known vs unknown email:

const user = await User.findOne({ email });
if (!user) throw new AppError('No account with that email', 404); // reveals registration status!

✅ Correct — always return the same response regardless:

const user = await User.findOne({ email });
// If user doesn't exist — still return success (same message)
res.json({ success: true, message: 'If that email is registered, a reset link has been sent.' });
if (!user) return; // exit silently without sending email
// If user exists — proceed to send the email

Mistake 3 — Storing raw reset tokens in MongoDB #

❌ Wrong — plaintext token in the database:

const token = crypto.randomBytes(32).toString('hex');
user.passwordResetToken = token; // if DB is breached, attacker can reset any password

✅ Correct — store the SHA-256 hash, send the raw token in the email:

const token = crypto.randomBytes(32).toString('hex');
user.passwordResetToken = crypto.createHash('sha256').update(token).digest('hex'); // hashed
await user.save();
sendEmail({ resetUrl: `${CLIENT_URL}/reset-password/${token}` }); // raw token in email ✓

Quick Reference #