Dorna Forms

forms.dorna.dev

The inbox for websites that don’t have a server.

A visitor writes. We keep the lead, email the owner, and send a clear success or error back to the page. If mail fails, the lead is still yours.

Open adminPaste the snippet

Public site key in the HTML. Secret admin key stays off the page.

Owner snippet

Create a site in admin, then paste the public key and form id into your static HTML.

Static HTML
<form data-dorna-form="form_YOUR_FORM_ID">
  <input name="name" required />
  <input name="email" type="email" required />
  <textarea name="message" required></textarea>
  <label>
    <input name="consent" type="checkbox" value="true" required />
    I agree to be contacted
  </label>
  <button type="submit">Send</button>
</form>
<script src="/v1/sdk.js" data-site-key="pk_YOUR_SITE_KEY"></script>

Save first

The submission is the source of truth. We write it before talking to Resend.

Then notify

Owners get mail from Dorna Forms <forms@notifications.dorna.dev>. Reply-To is the visitor.

Refuse the junk

Unknown site, bad origin, paused form, honeypot, failed Turnstile, or a flood — rejected with a plain error.

One snippet. Any static site.

Each site gets a public key that is safe to paste into HTML, its own forms, notify emails, and allowed origins. A second site does not need a second backend.

  • Name, email, message, consent — plus extra text fields you define.
  • Double-clicks reuse the same event id. One lead, one email.
  • No visitor auto-replies. That would burn the Resend free tier.
Paste into any static page
<form data-dorna-form="form_YOUR_FORM_ID">
  <input name="name" required />
  <input name="email" type="email" required />
  <textarea name="message" required></textarea>
  <label>
    <input name="consent" type="checkbox" value="true" required />
    I agree to be contacted
  </label>
  <button type="submit">Send</button>
</form>
<script src="/v1/sdk.js" data-site-key="pk_YOUR_SITE_KEY"></script>

forms.dorna.dev

Website and API

Browsers talk here. Host the submit endpoint and sdk.js. Map this name to the Cloud Run service. If DNS is on Cloudflare, keep the record DNS-only so Google can issue the certificate.

notifications.dorna.dev

Mail identity only

Emails are sent from this domain via Resend (SPF, DKIM, DMARC). It is not the website. Do not point this name at the app.