Buttondown Release Notes

Announcement bar on archive pages

You can now add an announcement bar to the top of your archive pages — a simple, eye-catching banner for sharing breaking news, special offers, or anything else you want readers to see first.

demo.buttondown.com/settings/archives/announcement

This is a live demo. You can view this page on our live demo site, too.

Head to Settings Archives Announcement to set it up. You can customize the message (Markdown works, so feel free to add links), pick a background color, and control who sees it: everyone, just free subscribers, just paid subscribers, or only logged-out visitors.

It's a small thing, but it's a nice way to highlight something important without having to add it to every email you send. Maybe you're running a holiday sale, or you want to nudge free readers toward a paid subscription, or you just want to say "hey, I'm on vacation until January" — the announcement bar has you covered.

disposables.app

We built and released a tiny little project: disposables.app, a free tool for easily checking whether or not an email address domain is disposable or otherwise problematic.

The database comes from many places. A big part of it is from our own traffic, of course—we've been fighting spam for years, and have built up a pretty comprehensive list of domains that we've seen used for abuse. But we're also grateful to Martin Cech for his project disposable-email-domains, which bootstrapped our initial database. Concomitant with the release of disposables.app, we've started sponsoring the project.

The tool is simple: type in a domain, and we'll tell you if it's disposable. You can also grab the full list as JSON from the API endpoint if you want to integrate it into your own projects.

This is the kind of thing that's useful for us internally, but we figured it might be useful for others too—so we're releasing it as a free, open tool. If you're building something that needs to validate email addresses, give it a try.

Hey folks!

You can now track your Bluesky follower count right in your analytics! If you've added your Bluesky profile to your newsletter's social links, you'll see a new "Bluesky followers" metric that shows how your follower count changes over time, starting from when you added your Bluesky profile to your newsletter's social links.

This might seem a bit random for us to do — and it is! But we're working on a few other social analytics features that will be coming soon that required this data anyway, so we might as well add it to the analytics page. ("Might as well" is not exactly an ironclad product strategy, but in this case it seems harmless enough.)

Head over to your analytics page and enable "Bluesky followers" if you want to start tracking it. You'll need to have your Bluesky profile URL set up in your newsletter's social links first—you can add that in your design settings.

(And, before you ask — Mastodon, Instagram, and a few others are coming soon too! We just need more time to bake out that data.)

You can now reply directly to conversations from your inbox!

When a subscriber replies to one of your emails, you'll see their message in your inbox—and now you can write back right there, without switching to your email client.

Just type your reply and hit send (or Cmd+Enter / Ctrl+Enter). Your response gets sent as an email to the subscriber and appears in the conversation thread, so you can keep track of the whole back-and-forth in one place.

This makes it way easier to have actual conversations with your subscribers, whether they're asking questions, sharing feedback, or just saying hi. No more context switching between Buttondown and your email app—everything lives in your inbox.

(We've been building toward this for a while—check out how conversations work if you want the full backstory.)

TK placeholders in Buttondown

If you've ever written for a newspaper or magazine, you might be familiar with "TK" a journalism shorthand for "to come" that marks placeholder text you need to fill in later. It's a handy way to keep writing when you don't have a fact, link, or quote ready yet.

Now Buttondown has your back: when you type TK (or TKTK, Tk, tk we're not picky) in your email, you'll see it highlighted right in the editor. And when you go to send, you'll get a friendly warning reminding you to fill in those placeholders.

No more accidentally sending "The event starts at TK" to your subscribers!

(p.s. credit where it's due. We stole this idea from Ghost. Thanks, Ghost!)

You can now randomize the order of answers in your surveys! This helps avoid position bias—where subscribers tend to pick the first option more often than they should.

Just flip the toggle in your survey settings:

demo.buttondown.com/surveys/new

This is a live demo. You can view this page on our live demo site, too.

Each subscriber sees a different (but consistent) order, so if they open the same email twice they'll see the same shuffle. This is great for polls where you want fair results, or any time you're curious whether "Option A" is winning just because it's at the top.

The API supports this too via the new randomize_answers field.

In late March, we put out an innocuous changelog entry announcing that our tracking infrastructure was now our own. The body of the entry was fairly non-descript: I wanted to find a quieter time to talk about the how and why, and that time is now.

Buttondown, just like most other platforms, relies on vendors like SendGrid or Postmark to actually handle the SMTP side of sending emails. These vendors also offer link and open tracking that they manage and inject on your behalf. Some platforms use these directly; others roll their own implementation. For a long, long time (five years!) we were the former.

This decision 1 to rely on Mailgun or whomever for click tracking 2 made sense at the time, but grew more painful as time passed:

• We currently send outbound emails through five different vendors, and standardizing the events across all five became increasingly annoying.
• The performance of tracking events was suboptimal, as we had to rely on webhooks to relay the events to our own servers.
• The privacy posture of outsourcing this is suboptimal relative to "owning this thing end to end".

Moreover: the benefits of outsourcing this, as valid as they are early on, became increasingly diluted as we scaled: as other parts of our application matured, our ability to handle spiky traffic, detect bots, and so on became less hinterlands-shaped and more like solved problems ready for re-use.

The beautiful part about a lot of this work is that it is, from a programming perspective, fairly simple.

For instance! Here is the entire implementation of our open tracking endpoint:

from django.http import HttpResponse
from django.http.request import HttpRequest
from ipware import get_client_ip
from emails.models.asynchronous_action.model import AsynchronousAction
from emails.models.subscriber.actions import track_open

def view(request: HttpRequest, compressed_id: str) -> HttpResponse:
    ip_address = get_client_ip(request)[0]
    user_agent = request.META.get("HTTP_USER_AGENT")
    compressed_payload = track_open.compress(
        track_open.Payload(
            compressed_id=compressed_id,
            ip_address=ip_address,
            user_agent=str(user_agent),
        )
    )
    AsynchronousAction.enqueue(
        track_open.__name__,
        [compressed_payload],
    )
    return HttpResponse()

"Okay", you say. "That's cheating. That just proxies out to a background job. Show me the background job."

That's the point! The background job was already implemented because we were using 95% of it for the email events from the vendors themselves. All we're doing is cutting out the middleman.

Don't don't roll your own

You always hear people in software development say you should never roll your own X. "Never roll your own auth or crypto or emails." There are very good and rational reasons not to mess with those. But you can't throw the baby out with the bathwater. As you mature as an engineer or an engineering organization, you've got to start asking yourself which rules you're accomplished enough to break. (Or, as I've written on my personal blog: the people telling you not to roll your own thing tend to benefit from your instead asking them to handle it for you.)

The truth is that Jack Donaghey is right: vertical integration unlocks synergies. Here are some basic examples of things we get to do now that we've insourced this stuff:

• Start populating our database of IPs and user agents of bots to help strengthen our spam detection for subscription traffic.
• Surface conversion funnels for individual archive pages.
• Throttle (or accelerate) email sending in real time based on engagement metrics.

And all of this stuff is, in the background, cheaper and safer and more private.

Two cakes

Running a software company tends to be about trade-offs. You can try and move quickly at the cost of stability, performance, or polish. You can raise prices and increase short-term revenue, but at the cost of growth and customer goodwill. You can do a feature freeze and focus solely on performance and bug fixes for a month or two, but then you slow down your enterprise sales.

But! Every so often an option presents itself that allows you to have your cake and eat it too. This was one such option: we got to decrease tech debt, increase performance, improve our security posture, and decrease costs, all at the same time. And the only downside is that "success" looks like nothing changed at all, which gives me the opportunity to blog about it.

Content Security Policy

We've enabled a strict Content Security Policy on all newsletter archives to improve the security posture for all users. Our list of allowed scripts still applies. If you find any issues regarding scripts or other content loading, please let us know!

For those curious, Content Security Policy (or CSP for short) is a feature in web browsers that allows websites to specify a list of where they're allowed to load scripts from. This improves the security of the website by avoiding any injection of third-party scripts that could compromise the users' session.