TLS Configuration

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• Cargo.toml
• src/lib.rs
• src/config.rs
• CHANGELOG.md

The Resend Rust SDK secures communication with the Resend API using Transport Layer Security (TLS). Configuration occurs primarily at compile-time through Cargo features, which determine the underlying cryptographic library used by the Reqwest HTTP client. The SDK also supports domain-specific TLS settings for email verification and tracking purposes.

Sources: README.md:12-14, src/config.rs:116-118

TLS Backend Selection

You select the TLS implementation by enabling specific crate features in your Cargo.toml. The SDK supports two main backends: native system libraries or a pure Rust implementation.

Available Crate Features

Feature	Description	Default
native-tls	Uses the system-native TLS implementation (e.g., OpenSSL on Linux, Security Framework on macOS, SChannel on Windows).	Enabled
rustls-tls	Uses the rustls library, a pure Rust TLS implementation.	Disabled

Sources: Cargo.toml:31-35, README.md:26-28

Dependency Mapping

The SDK maps these features directly to the reqwest dependency to configure the client's internal security layer.

The diagram shows how crate features dictate the TLS backend used by the internal HTTP client to communicate with the Resend API.

Sources: Cargo.toml:34-35, Cargo.toml:135-140

Client Architecture

The Resend client utilizes a Config object that holds a pre-configured reqwest::Client. Secure communication is enforced by the default base URL https://api.resend.com.

Initialization Flow

1. You initialize the Resend client using Resend::default() or Resend::new().
2. The Config struct constructs a reqwest::Client.
3. TLS is initialized based on the enabled Cargo features during client construction.
4. Every request built via Config::build uses the HTTPS scheme.

The sequence diagram illustrates the initialization of the secure context and the subsequent TLS handshake during an API call.

Sources: src/config.rs:116-128, src/config.rs:145-153

Domain-Level TLS Configuration

The SDK provides data structures to manage TLS settings for specific sending domains. This allows you to update the security status of domains via the API.

Domain Security Types

The Tls type is exported within the domain management module to represent the TLS status of a domain resource.

• Tls Enum: Represents the TLS configuration state for a domain.
• DomainChanges: Contains a tls field used when updating domain settings to modify the active TLS configuration.

Sources: src/lib.rs:207, CHANGELOG.md:329, CHANGELOG.md:465

Key API Types

Type	File Source	Description
Tls	src/lib.rs	Re-exported type representing domain TLS status.
DomainChanges	src/lib.rs	Struct for modifying domain properties, including TLS.

Sources: src/lib.rs:205-212

Environment Overrides

You can influence the connection behavior via environment variables, though the TLS backend remains fixed at compile-time.

• RESEND_BASE_URL: Overrides the default https://api.resend.com. If you provide a custom URL, it must support HTTPS to maintain security, as the internal RequestBuilder utilizes the provided scheme.

Sources: src/config.rs:116-121, README.md:32-33

Conclusion

TLS configuration in the resend-rust SDK is primarily managed through Cargo feature flags to select between native-tls and rustls-tls. By default, the SDK leverages the system's native security libraries to ensure all traffic to the Resend API is encrypted via HTTPS. For advanced domain management, the SDK provides the Tls and DomainChanges types to programmatically control domain-level security settings.