## Automate bounce and complaint suppression
1. Create a webhook endpoint in your app and register it in the Resend dashboard. Subscribe to `email.bounced` (permanent rejections), `email.complained` (marked as spam), and `suppressions.added` (already suppressed addresses).
2. On every send, attach tags identifying the tenant or campaign, for example `{'name': 'tenant_id', 'value': 'tenant_abc123'}`. Tags arrive in webhook payloads, which is how you route a bounce back to the right tenant in a shared account. Docs: https://resend.com/docs/webhooks/event-types
3. When `email.bounced` arrives, add the address to your suppression list through the suppressions API. Resend auto-suppresses future deliveries to that address, but it does not unsubscribe the contact for you; do both so broadcasts stop too.
4. When `email.complained` arrives, treat it like a bounce and suppress immediately. A complaint is a deliverability emergency; every extra send to that address makes it worse.
5. Store every webhook event with its event id and deduplicate on receipt. Webhooks retry, and processing the same bounce twice can double-count or re-trigger side effects.
6. Verify webhook signatures before processing anything. An unverified endpoint lets anyone inject fake bounce events and suppress your real users.
7. Run a weekly report: top bounced domains and the bounce rate per sending stream. If a stream crosses 4% bounces, pause sends and clean the list before warming it back up.