How we built the DEV3 Mailtide: consent-aware lists and idempotent sending

DEV3 Mailtide is a self-hosted email marketing platform on Laravel 12 and Filament 4: workspaces with lists, segments, campaigns and automations, and an operator panel for plans and sending servers.

Decisions that mattered

• Every list membership stores its source, time, IP and the exact wording shown. Imports must state a consent basis and never revive an unsubscribed, bounced or complained address.
• A campaign is prepared in one transaction that takes the monthly usage row, then the campaign row, snapshots the audience with a single insert-select and reserves quota.
• Sender workers claim a batch with one UPDATE through a derived table, then recheck the contact, suppression and membership while holding the contact row lock, so an unsubscribe either lands first or waits.
• Message-IDs are deterministic, so a retry after a crash is idempotent on drivers that support it.
• The segment compiler turns a rule tree into whereExists queries that run unchanged on SQLite and MySQL and is tested against an independent reference evaluator.
• Tracking tokens are HMAC-signed, and bot and privacy-proxy opens are separated from human ones.

Limits: no mobile apps, and every provider sits behind a driver interface with a simulated driver for testing.

Trade-off we chose: bot, scanner and privacy-proxy opens are separated from human ones.

How do you handle unsubscribe races? Feedback welcome.