listmonk

Running a double opt-in newsletter on a small server

Deploy the Compose file behind a reverse proxy with TLS, set the root URL under Settings, General, and create a public double opt-in list. Embed the generated subscription form or link to the hosted form page, enable a CAPTCHA, and add {{ UnsubscribeURL }} and {{ TrackView }} to the campaign template footer. Before the first send, check that only the public routes listed in the configuration docs (subscription pages, link redirects, tracking pixel, uploads and provider webhooks) are reachable from the internet while /admin and /api stay restricted.

Sending transactional mail from an application

Create a transactional template under Campaigns, Templates and an API user with the tx:send permission. The application then calls POST /api/tx with the template ID, recipient and a JSON data object referenced in the template as .Tx.Data. Use external mode for recipients who are not subscribers, multipart requests for attachments and altbody for a plain-text part. The documented response is only {"data": true}, so check delivery outcomes in the SMTP provider and in the bounce records rather than in the API call.

Segmenting an audience by attributes

Import subscribers from CSV with their attributes as JSON, then filter them on the Subscribers page with expressions such as subscribers.attribs->>'city' = 'Bengaluru' or an EXISTS subquery on campaign_views. Add the result to a dedicated list and target the campaign at that list. Because the SQL runs read-only but across all data, keep subscribers:sql_query to trusted roles, and consider a restricted Postgres role as the permissions guide suggests.

Delivering through Amazon SES with automatic bounces

Add SES as an SMTP server, then follow the bounce guide: enable bounce processing and webhooks, create an SNS topic, paste its ARN into the allowed list and subscribe /webhooks/service/ses over HTTPS. The guide suggests blocklisting after one hard bounce or complaint and taking no action on soft bounces until a count of two. Test with the SES simulator addresses for soft bounces, hard bounces and complaints, and confirm that each subscriber ends in the expected state.

Sharing one instance across teams

Define user roles for campaign editors and senders, keeping campaigns:send separate from campaigns:manage, and list roles that limit each team to its own lists. Connect an OIDC provider such as Keycloak or Authentik, enable auto-creation with a default role if required, and require TOTP for local accounts. Restrict users:manage, which can create Super Admins, and review which file types media uploads accept, since the security policy treats uploaded SVG or HTML as an administrator decision.

Keeping listmonk in sync with a CRM

The integration guide offers two routes: the subscriber APIs for create, update and the newer partial PATCH, or bulk CSV uploads to the import API. Advanced setups may write directly to the subscribers, lists and subscriber_lists tables described in schema.sql. Decide which system owns consent and unsubscribe state, and verify that an unsubscribe in listmonk flows back before the CRM re-imports the contact.