--- title: "Configure outgoing email" description: "Choose how the console sends invitations, alerts, and sign-in codes, test a provider before you switch to it, and set up DKIM and BIMI." url: "https://support.outpostplatform.com/depot/email/" product: "depot" type: "how-to" status: "draft" ai_summary: "Settings > Email: outgoing email providers (Outpost Cloud Email, your own SMTP server, SendGrid, SMTP2GO, Mailgun, Postmark, Amazon SES, Mailjet), one active at a time, test sends, DKIM, BIMI, and custom headers. The Sending domain card verifies your domain with CNAMEs so ticket mail comes from your support address, else the Outpost sender with your Reply-To." availability: plans: ["home-lab", "essentials", "enterprise", "msp"] permission: "mailbox:manage" preview: false source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/depot/email.md" license: "CC BY 4.0" --- # Configure outgoing email Outgoing email is how the console sends invitations, alert notifications, sign-in codes, and security notices. You can configure several providers, test each one, and send through one active provider at a time. This page shows how to add a provider, switch to it, and set the sender identity that applies whichever provider carries the mail. **Settings** > **Email** covers mail the console sends. Mail that comes in and becomes tickets is set up under **Settings** > **Mailboxes**. See [Email to ticket](/service-desk/mailboxes/). Ticket replies from a mailbox that has no sending path of its own also go out through the active provider here. ## Before you begin - You need `mailbox:manage`. Among the built-in roles, only the owner holds it. Anyone else sees **You need the mailbox permission to manage outgoing email.** - For an API provider, have an account with the provider, an API key, and a sending domain you have verified with them. - For your own SMTP server, have its hostname, port, encryption, and, if it asks for them, a username and password. ## Choose a provider | Provider | Uses | Notes | | --- | --- | --- | | **Outpost Cloud Email** | Nothing to set up | Outpost sends from its own address, with your name on the message and replies going to the address you choose. It cannot be deleted. | | **Your own SMTP server** | **Hostname**, **Encryption**, **Port**, **Username (optional)**, **Password**, **Return path (optional)** | Any relay you run, such as Exchange, Postfix, or a smart host. The only option on Remote Outpost. | | **Twilio SendGrid** | **API key**, **IP pool (optional)** | A key with the Mail Send permission, for a verified sending domain. | | **SMTP2GO** | **API key** | The sender address must be a verified sender. | | **Mailgun** | **Private API key**, **Sending domain**, **Region** | **United States** or **Europe**. Mailgun's EU region is a separate service, and the wrong region reports the domain as missing. | | **Postmark** | **Server API token**, **Message stream** | Transactional mail goes through the outbound stream. | | **Amazon SES** | **Access key ID**, **Secret access key**, **AWS region**, **Configuration set (optional)** | An IAM access key with `ses:SendEmail`, in the region where your identity is verified. | | **Mailjet** | **API key**, **Secret key** | The key pair from your Mailjet account settings. | Remote Outpost has no internet connection, so it offers only **Your own SMTP server**. ## Add a provider 1. Go to **Settings** > **Email**. 2. On the **Providers** card, select **Add email provider**. 3. In **Name**, enter a name you will recognize, such as `Exchange relay`. 4. In **Provider**, choose the provider. 5. In **From address**, enter the address mail is sent from. **Outpost Cloud Email** has no **From address**, because it sends from Outpost's own address. 6. In **From name**, enter the name recipients see, such as your help desk's name. 7. In **Reply-to (optional)**, enter where replies should go. 8. Fill in the fields your provider uses. For your own SMTP server, choose **STARTTLS (usually port 587)**, **Implicit TLS (usually port 465)**, or **None** in **Encryption**. 9. Select **Save provider**. :::caution **None** sends message contents across the network unencrypted, and no username or password can be sent. Use it only for a relay on your own network that does not ask for credentials. ::: Some API providers offer **Track when a message is opened** and **Rewrite links to track clicks**. Leave click tracking off. The provider carries sign-in codes and invitations, and a rewritten link in a security email looks like a phishing link. Credentials go one way. The console never shows a saved password, API key, or secret again. When you edit a provider, leave those fields blank to keep the current values. ## Test a provider Test a provider before you make it active. A test goes out through that provider whether or not it is the active one. 1. On the provider's row, select **Send test**. 2. In **Send a test message to**, enter your own address. 3. Select **Send**. The **Last test** column shows **Delivered** or **Failed**. A failure shows the provider's error under the row. ## Make a provider active Select the radio button in the **Active** column of the provider's row. Mail goes out through the active provider from then on. You cannot disable the active provider, and you cannot delete it while another provider exists. Make a different provider active first. **Outpost Cloud Email** has no **Delete**. **Disable** keeps a provider's settings without letting it be chosen. ## Set the sender identity The **Sender identity** section applies to every message on every provider. ### DKIM signing DKIM signing applies when you send through your own SMTP server: Outpost signs each message before it leaves. API providers sign with their own keys for the domain you verified with them, and ignore these settings. 1. In **Signing domain**, enter your domain, such as `example.com`. 2. In **Selector**, enter a selector, such as `outpost`. 3. In **Private key (PEM)**, paste an RSA or Ed25519 private key in PEM format. 4. Select **Save identity settings**. 5. Publish the TXT record the card shows, at the name it shows. Messages are signed as soon as the record resolves. Until then they still send, and receivers treat them as unsigned. The private key is never shown again. To stop signing, select **Remove signing key**. ### BIMI BIMI shows your logo beside your messages in inboxes that support it. It is published as DNS, so nothing here is sent with a message. It does nothing until your DMARC policy is at enforcement (`p=quarantine` or `p=reject`), and most inboxes also want a Verified Mark Certificate. 1. In **Logo URL (SVG, over HTTPS)**, enter the address of your SVG logo. 2. In **Verified Mark Certificate URL (optional)**, enter the address of your certificate, if you have one. 3. Select **Save identity settings**. 4. Publish the TXT record the card shows. ### Custom headers Under **Custom headers**, select **Add a header**, and enter a **Header** and **Value** to add to every outgoing message, such as a tag for your own mail filters. Headers Outpost sets itself cannot be overridden. Select **Save identity settings**. ## Send ticket mail from your own domain With **Outpost Cloud Email**, ticket replies and notifications go out from Outpost's own sender until you verify your domain. Verify it on the **Sending domain** card, and ticket mail comes from your support address instead. The card is part of the service desk, on Enterprise and MSP, and is not available on Remote Outpost. Until the domain is verified, mail still goes out. It comes from the Outpost sender, with your support address as Reply-To, so customer replies still reach your mailbox. Nothing is refused while DNS catches up. 1. Go to **Settings** > **Email**. 2. On the **Sending domain** card, in **Domain**, enter the part after the @ in your support address, such as `contoso.com`. 3. Select **Add domain**. The card lists the CNAME records to publish, each with its **Name** and **Value** and a copy button. 4. Add each CNAME record at your DNS host, exactly as shown. 5. Wait for the records to be found. The card checks again every 30 seconds while it is open, and **Check now** checks at once. Verification usually finishes within an hour. Each record shows **Found** or **Not found yet**, and the domain shows **Waiting for DNS**, **Verified**, or **Not verified**. A failed check shows the reason under the domain. Once the domain shows **Verified**, ticket mail sent through Outpost Cloud Email comes from the support mailbox's address and display name. Keep the records in place. **Remove** removes the domain, and mail goes from the Outpost sender again. This applies to **Outpost Cloud Email** only. Other providers send from the address and domain you verified with them. A mailbox connected to Microsoft 365 or Google Workspace, or one that sends through its own SMTP server, sends its replies itself and does not use this card. ## Verify The **Providers** card shows your provider with the radio button selected in **Active** and **Delivered** under **Last test**. Invite a colleague and check that the invitation arrives. See [Invite your team](/depot/invite-your-team/). ## If something goes wrong | Symptom | Cause | Fix | | --- | --- | --- | | **No outgoing email configured. Invitations and alerts cannot be sent until one provider is active.** | No provider is configured. | Add a provider and make it active. | | **Failed** under **Last test** | The provider refused the message. The error under the row says why. | Check the credentials, the sending domain, and the region. | | Messages arrive but fail DKIM | The TXT record is not published, or does not match. | Publish the record exactly as the card shows it. | ## Next steps - [Invite your team](/depot/invite-your-team/) - [Security notices and SMS](/depot/security-notices/)