Skofi Outreach: deliverability rules the database refuses to break
A prospecting and email-sequencing platform where the three rules that protect your sending domain are Postgres constraints, not application logic.
- safety rules in SQL
- 3
- build phases shipped
- 9
- subject-line testing
- A/B
The problem
Cold outreach tooling fails in ways that are expensive and slow to reverse. A pattern-guessed address that bounces, a double-send from two schedulers firing at once, an unsubscribe that stops one sequence but not the other two: each of those damages a sending domain reputation that takes months to rebuild.
All three failures share a shape: they are guarded by application code, and application code gets refactored.
What we built
Put the safety rules in SQL
Three constraints live in the schema. An address cannot be marked verified without a verification source and timestamp, so a guessed first-name-dot-last-name address can never enter the sendable pool. A sequence step can send only once per enrolment, so two cron ticks running concurrently cannot double-email a prospect. Suppressing an address cascades: one insert stops every enrolment and marks the contact, with no application code involved.
Test the constraints, not just the app
The schema ships with functional tests that run against a scratch database, and they are the acceptance gate: all of them must pass before the thing is allowed near a real domain. They are what stop the system from damaging the asset it depends on.
Scheduling inside the database
Sequencing runs on Postgres scheduling and HTTP extensions rather than an external worker, which keeps the send decision in the same transactional world as the constraint that guards it.
Guarding the privileged client three ways
The service-role database client is triple-guarded: a server-only import so a client component referencing it fails the build, a runtime check for a browser context, and a lint rule restricting it in shared interface code.
A checklist before the first real send
Separate sending domain, SPF, DKIM and DMARC passing, two weeks of warmup, a real postal address in the footer, a working unsubscribe link that has actually been clicked, and five emails sent by hand and read on a phone. Written down, because the failure mode is enthusiasm.
The outcome
Nine build phases delivered, plus CSV export, a LinkedIn task queue, and A/B subject variants with a per-variant reply-rate report on the sequence editor.
Reply and bounce detection close the loop automatically, so a responding prospect stops receiving the sequence.
Every route except the public unsubscribe, tracking and setup paths requires a session, enforced in middleware rather than per-page.
A deployment with no database configured renders a setup page instead of erroring. The failure state is legible.
Built with
- Next.js
- Supabase
- PostgreSQL
- pg_cron
- pg_net
- TypeScript
- Vitest
- Vercel
Where this is applied
Page copy drafted with AI assistance. Skofi is accountable for it. Editorial policy
Have something shaped like this?
If any part of the above resembles a problem you are living with, a short call is the fastest way to find out whether it is the same problem underneath.
What happens on the call
- 15 minutes, no deck
- We map the process on the call
- A written scope, or an honest no