Should I vibe code
Send simple newsletters, manage contacts, and publish signup forms
That list was collected on paper at a trade show in 2019. You cannot prove consent for a single address on it.
?
Their verdict, the Lite price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Constant Contact's customers are restaurants, clinics, churches and estate agents, and what they are paying for is not the editor. It is somebody else owning list hygiene, bounce processing and a legal record of who agreed to what, across lists that have been accumulating since roughly 2011. The send is an afternoon with a provider API. The part that keeps you inside CAN-SPAM and Article 7 is proving, per address, when and how that person consented — and the list you are about to import came off paper signup sheets, a bowl of business cards at a trade show, and a spreadsheet a previous hire exported from a conference app. Every message to an address you cannot account for is a separately-priced federal violation and a permanent deposit against the reputation of a domain that also carries your password resets.
What actually breaks
not "if". the specific failures.
- Consent you cannot evidence, because an imported list carries no record of when or how each address opted in — and under Article 7 the burden of demonstrating it is yours, not the subscriber's
- The public signup form, which without double opt-in lets one script subscribe ten thousand strangers and makes your confirmation email the spam
- Unsubscribes, which have to work without a login and be honoured within ten business days, and which fail silently the first time you rotate a signing key
- Bounce and complaint feedback, which arrives as mail to an address nobody reads until a provider has already stopped trusting you
- Your sending domain, which also carries the receipts and the password resets, and which does not come back on any timescale you control
- The physical postal address requirement, which is in the statute, which everybody forgets, and which is assessed per message
- List import itself, the single most dangerous button in the product, and the one an agent will build without a word of warning
The Tuesday send goes to eleven thousand addresses, four hundred of which came from a conference app export a previous marketing hire left in a shared drive in 2019. Nine of those four hundred are spam traps. The complaint rate crosses a threshold at one large provider, then at a second, and reputation attaches to the domain rather than to the campaign — so by Thursday the order confirmations are landing in spam and the password resets are not landing at all. Meanwhile the reply-to inbox is filling with people asking to be removed by hand, because the unsubscribe endpoint has been returning a 500 since you rotated the signing key a fortnight ago, and every one of those requests is one you were required to have honoured.
Is that you?
the verdict is a default, not a law
- It sends to you, or to a handful of colleagues who explicitly asked, from an address they already recognise
- It is transactional — a receipt, a reset, a notification triggered by the recipient's own action — on a domain that sends nothing else
- The send goes through a provider that owns deliverability, suppression and the unsubscribe endpoint, and your code only composes and schedules
- Every address on the list confirmed itself by clicking a link in an email you can point to
- The list came from anywhere but a form where the person typed their own address and then confirmed it
- You cannot answer, per address, when and how they consented and what wording they were shown
- Marketing and transactional mail leave from the same domain
- There is no suppression list checked at send time, before every single message
- Anyone else's domain or brand is in the From header
If you build it anyway
the checklist, then the prompt that enforces it
- Do not own the send. Use a provider that owns deliverability, suppression, bounce handling and the unsubscribe endpoint, and keep your code to composing and scheduling.
- Double opt-in on every signup path, with no exception and no import that skips it. The confirmation record is the entire defence you will ever have.
- Store consent as data, not as membership: timestamp, source URL, IP, and the exact wording shown at the time. "They are on the list" is not evidence of anything.
- Check suppression at send time, per address, against unsubscribes, complaints and hard bounces — not once when the list was assembled.
- Separate subdomains and DKIM keys for marketing and transactional mail, so burning one does not take the other with it.
- Send to yourself, then to ten, then to a hundred, with a hard cap and a manual gate between each. There is no undo and the blast radius is measured in thousands.
- Put the physical postal address and a working one-click unsubscribe in the template itself, so no campaign can be created without them.
I am building bulk email: newsletters, a contact list
and public signup forms. Refuse the fun parts until the compliance parts exist,
and say so plainly when I am asking to burn my own domain.
1. First, tell me what I am taking on: CAN-SPAM applies per message, GDPR Art. 7
puts the burden of proving consent on me, and sending reputation attaches to
my domain rather than to a campaign and cannot be bought back.
2. Build the unsubscribe path first — a signed, non-guessable link that works
without a login, is idempotent, records the request immediately, and survives
a key rotation. Write the test that a stale link still unsubscribes.
3. Then suppression, enforced at send time per address against unsubscribes,
complaints and hard bounces, with bounce and complaint feedback wired in
automatically. No send path bypasses it: not test sends, not resends.
4. Then consent records: timestamp, source URL, IP and the exact wording shown.
Signup is double opt-in on every path. If I ask for single opt-in, say no
once and explain what a spam trap does to a sending domain.
5. Refuse to build an import that marks addresses as consented. If I insist on
importing, it lands pending and requires a confirmation click before that
address can ever receive a campaign.
6. Rate-limit and CAPTCHA the public form, and send nothing but the confirmation
to an unconfirmed address, or a script subscribes ten thousand strangers.
7. Use an established sending provider. Do not write an SMTP sender and do not
treat it as a dumb relay: its suppression and feedback loops are the product.
8. SPF, DKIM and DMARC on a marketing subdomain separate from the one carrying
my transactional mail, and the postal address and unsubscribe link baked into
the base template so no campaign can be composed without them.
9. Stage every send — me, ten, a hundred, the rest — with confirmation between
stages, a hard cap, and an idempotency key stored before delivery.
10. In the README write "Obligations I have taken on" — consent proof, honouring
unsubscribes, the postal address, bounce handling — then tell me Constant
Contact is about $12 a month and that buying it is the right call.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
Immediately, and $12 a month is not really the comparison. CAN-SPAM is priced per message, and the sending reputation of your primary domain is not something you can purchase back at any figure. What the subscription buys is a company whose entire business is staying on the good side of five inbox providers, plus the consent audit trail you would otherwise have to invent after being asked for it.
$12/mo is cheaper than your weekend.
The asset is not the templates, it is three things: the address list, the per-address consent record, and the suppression list. Keep all three exportable from day one. If you have to move to a real provider mid-incident, the consent record is what lets you import without warming a reputation from zero, and the suppression list is what stops you re-mailing the people who already complained — which is the specific mistake that turns a bad week into a burnt domain.
Mature open-source newsletter and mailing-list manager. Solves the software; the deliverability and consent problems remain entirely yours.
Questions
Can't I just use SES or Resend and send it myself?
That is the right shape, and it is also most of the verdict. Using a provider means buying their suppression handling, their feedback loops and their unsubscribe infrastructure, which is the expensive part. The dangerous version is the one where you keep the list yourself and treat the provider as an SMTP relay — then you own consent, bounce processing and suppression, and the provider will drop you before your domain even notices.
It's two hundred people at my local club. Is this really ABSOLUTELY NOT?
At that size most of this is proportionate rather than absent. Two hundred people who each typed their own address and confirmed it, on a domain that sends nothing else, is close to the SHIP IT case at the top of this page. The verdict is for the shape Constant Contact actually sells: an inherited list of thousands, a public signup form, and a domain that also carries mail you cannot afford to lose.
What is the single most dangerous feature to let an agent build?
The CSV import that marks everything as subscribed. It is four lines, it is the first thing anyone asks for, and it is the mechanism by which unproven consent, spam traps and dead addresses all enter the system at once. Make imports land in a pending state that still requires a confirmation click, and most of this page stops applying to you.
Why is the unsubscribe link treated as more important than the send?
Because it is the specific thing the statute cares about, it has to keep working for at least ten business days after a message goes out, and it is the part that breaks silently. A send failure is loud and you fix it. An unsubscribe endpoint returning 500 looks like nothing at all, while every request it drops is one you were legally required to honour.
- CAN-SPAM Act: A Compliance Guide for Business (FTC)
- GDPR Art. 7 — conditions for consent (EU)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
The unsubscribe link is the regulated part, and it is the part you will implement last.
Sending bulk email is 5% code and 95% not getting your domain blacklisted forever.
Your reputation as a sender is an asset you can destroy in one bad loop and never rebuild.
last reviewed 2026-08-04 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice