---
title: "Email to ticket"
description: "How mail to your support address becomes tickets, the ways to connect a mailbox, and how Outpost decides which senders to trust."
url: "https://support.outpostplatform.com/service-desk/mailboxes/"
product: "depot"
type: "concept"
status: "draft"
ai_summary: "Settings > Mailboxes connects a support mailbox (Microsoft 365, Google Workspace, IMAP, or forwarding) so mail becomes tickets. Replies go out through the arriving mailbox and thread by headers. Senders are verified by contact or DMARC; unknown senders open unverified tickets that send no email until a technician selects Verify sender. Daily health check and Suspended mail."
availability:
  plans: ["enterprise", "msp"]
  permission: "mailbox:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/service-desk/mailboxes.md"
license: "CC BY 4.0"
---

# Email to ticket

Email to ticket turns messages sent to your support address into tickets. You
connect a mailbox under **Settings** > **Mailboxes**, and each new message
becomes a ticket in the queue you choose. A reply to that ticket's email joins
the same ticket. Your technicians answer from the console, and the requester
gets an ordinary email from your support address. This page explains how it
works and the choices you make when you set it up.

## How email becomes a ticket

Outpost checks each mailbox for new mail on a schedule, no more often than
every 30 seconds. For each message it:

1. Drops mail it sent itself, such as its own test and daily check messages.
2. Holds anything it should not ticket, such as spam, automatic replies, and
   mail that fails sender authentication, in
   [Suspended mail](/service-desk/suspended-mail/).
3. Looks for the ticket the message replies to. A reply joins that ticket. See
   [Email threading](/service-desk/email-threading/).
4. Opens a new ticket for anything else, in the mailbox's queue, with the
   mailbox's default priority and category.
5. Saves the attachments, and adds the people on **Cc** as participants on
   the ticket.
6. Marks the message as read in the mailbox.

Outpost never deletes mail from your mailbox. Microsoft 365 and Google
Workspace mail is marked as read and left where it is. IMAP mail is marked as
read and, where the server supports it, moved to a folder named
`Outpost/Processed`.

Outpost collects mail that arrives after you connect the mailbox. Older mail
stays in the mailbox and does not become tickets.

## Ways to connect a mailbox

**Add mailbox** opens the **Add a support mailbox** wizard. It asks for the
address, checks who hosts it, and recommends a way to connect. You can choose
another.

| Method | Use it when | Replies go out through |
| --- | --- | --- |
| **Microsoft 365 app connection** (recommended for Microsoft 365) | The mailbox is in Microsoft 365, including a shared mailbox. An admin approves the Outpost Mail app once and runs a script that limits it to this one mailbox. Nothing expires. See [Connect a Microsoft 365 mailbox](/service-desk/connect-microsoft-365/). | Microsoft 365, from the mailbox itself |
| **Sign in as the mailbox** | You want Microsoft 365 connected quickly and can renew the sign-in when it expires. | Microsoft 365 |
| **Your own Entra app registration** (advanced) | Your organization manages its own app registration. | Microsoft 365 |
| **Google Workspace domain-wide delegation** (recommended for Google Workspace) | The mailbox is in Google Workspace. A super admin authorizes Outpost once in the Admin console. See [Connect a Google Workspace mailbox](/service-desk/connect-google-workspace/). | Gmail, from the mailbox itself |
| **Your own Google service account** (advanced) | You want a service account from your own Google Cloud project. | Gmail |
| **IMAP with a password** | Any other host, such as Zoho Mail, Fastmail, or iCloud Mail, or a personal Gmail or Yahoo account. See [Connect a mailbox with IMAP](/service-desk/connect-imap/). | The mailbox's SMTP server, or your outgoing email provider |
| **Forward mail to Outpost** | You cannot or do not want to give Outpost access to the mailbox. Your mail host forwards a copy of every message to an Outpost address. See [Forward email to Outpost](/service-desk/forward-email/). | Your outgoing email provider |

When replies go out through your outgoing email provider, their Reply-To is
the support mailbox's address, so customer replies come back to it. See
[Configure outgoing email](/depot/email/#send-ticket-mail-from-your-own-domain).

After you connect, the wizard tests the mailbox: it connects, signs in,
checks its access, sends a test message to the mailbox, and waits for it to
arrive. Then you choose where new tickets land.

## Replies and threading

A technician's public reply goes out as an ordinary email from the mailbox the
ticket arrived on. The subject carries the ticket number with a short check
code, such as `[OUT-1042-7f3a]`, and the message carries headers that let the
customer's reply find its ticket. See
[Email threading](/service-desk/email-threading/) and
[Ticket notification emails](/service-desk/ticket-notifications/).

## Sender verification {#sender-verification}

Anyone can put any address in a message's From line. Before Outpost emails a
sender back, it checks that the mail really came from them. A sender is
verified when one of these is true:

- The address belongs to a known person at the client.
- The message passes sender authentication: DMARC, or SPF or DKIM aligned with
  the From domain.
- You allow the sender, or turn on **Trust all senders**.

Mail from a sender Outpost cannot verify still becomes a ticket, marked
**Unverified sender**. No email goes out on that ticket, to the sender or to
anyone they copied, until a technician checks who sent it and selects
**Verify sender** on the ticket. Verifying needs `ticket:write`. See
[Tickets](/service-desk/tickets/#tickets-from-email).

You can choose per mailbox to hold that mail instead. In the wizard's
**Routing** step, set **Senders Outpost cannot verify** to **Hold in Suspended
mail for review**. The mail then waits in
[Suspended mail](/service-desk/suspended-mail/) until someone releases it.

Mail that fails DMARC is never ticketed unless you allow the sender. It goes
to Suspended mail as **Failed sender authentication**.

### Trust all senders

**Trust all senders** treats every sender as verified. Every message becomes a
ticket and replies go back to whoever sent it, including spoofed senders
pretending to be a client. Leave it off unless your mail filter already blocks
spoofing. The setting is on the **Automatic tickets** tab of
[Desk settings](/service-desk/desk-settings/#email-senders), and each mailbox
can override it in its **Senders** setting. Mail that fails DMARC or comes
from a blocked sender is still held.

### Allow and block senders

From a message in Suspended mail you can **Allow sender**, **Block sender**,
or **Block domain**. Mail from an allowed sender is ticketed as verified, even
when it fails DMARC. Mail from a blocked sender or domain is held as
**Blocked sender**, and a block wins over an allow.

## Client email domains {#client-email-domains}

On the MSP plan, a mailbox set up for your practice can take mail for every
client. Outpost decides which client a new ticket belongs to from the sender:

1. A sender whose domain is one of a client's email domains is that client's.
   If the sender is not yet a contact, Outpost adds them as one.
2. A sender who is a known person at a client is that client's.
3. Otherwise, the mailbox's default client, chosen in the **Client** setting.

Add a client's domains on the client's record, on the **Email domains** card.
Enter the domain, such as `contoso.com`, in **Add a domain** and select
**Add**. A domain belongs to one client only, and a public mail domain such as
`gmail.com` is refused. Domains the client already uses for portal sign-in are
listed too, marked **From portal sign-in**, and are removed from the portal
settings rather than here. See [Clients](/msp/clients/#read-a-clients-record).

A client domain decides which client a ticket belongs to. On its own it does
not verify the sender: mail from a client's domain that fails sender
authentication opens an unverified ticket for that client.

## CC subscribe

People on **Cc**, and people on **To** other than the support mailbox, are
added to the ticket as CC participants, so they receive its emails. This
happens on a new ticket and on a reply that threads by its headers. Up to 20
people are added from one message. These are never added:

- Your own mailboxes and Outpost's own addresses.
- The requester.
- Blocked addresses.
- Role addresses: `postmaster@`, `mailer-daemon@`, `noreply@`, `no-reply@`,
  and `donotreply@`.

On an unverified ticket the CCs are added but sent nothing until a technician
verifies the sender.

## Reply cleanup and the original message

Customers reply above the quoted history, and their mail apps add
signatures. Outpost removes the quoted history and the signature, so the
ticket shows what the customer wrote this time. Select **Show original** under
a message to see the full text as it arrived, and **Download the .eml file**
to get the message itself.

Attachments are saved on the ticket. Small inline images, such as signature
logos and tracking pixels, are left out. An attachment over 25 MB is not
saved, and an internal note on the ticket lists it.

## Automatic replies and floods

An out-of-office reply or other automatic message never opens a ticket. If it
replies to a ticket, it is added as an internal note and nobody is notified.
Otherwise it goes to Suspended mail as **Automatic reply**.

If one sender opens 20 new tickets in an hour, further new mail from them
goes to Suspended mail as **Too many messages**. Replies to existing tickets
are not affected.

## Health and the daily check

Each mailbox shows its health in the list: **Connected**, **Needs
attention**, **Reconnect needed**, **Waiting for first sync**, or **Off**.
Once a day Outpost sends a message to each mailbox through its own reply path
and checks that it arrives. When a mailbox stops working, Outpost raises an
alert. See [Troubleshoot a support mailbox](/service-desk/mailbox-health/).

## Plans and Remote Outpost

Email to ticket is part of the service desk, on Enterprise and MSP. On a plan
without it, the mailbox pages show a lock and no mail is collected. See
[Plan-locked features](/depot/plan-locked-features/).

[Remote Outpost](/remote-outpost/) has no internet connection, so only **IMAP
with a password** is available. The other methods show **Not available on an
offline server.** Replies go out through the mailbox's SMTP server or the **Your own SMTP server** provider in
**Settings** > **Email**.

## Permissions

`mailbox:manage` covers every mailbox page, including reading the list,
because a mailbox holds credentials to a mail server. It also covers
Suspended mail, client email domains, and **Trust all senders**. Among the
built-in roles, only the owner holds it. See
[Roles and permissions](/depot/roles-and-permissions/).

## Related

- [Connect a Microsoft 365 mailbox](/service-desk/connect-microsoft-365/)
- [Connect a Google Workspace mailbox](/service-desk/connect-google-workspace/)
- [Connect a mailbox with IMAP](/service-desk/connect-imap/)
- [Forward email to Outpost](/service-desk/forward-email/)
- [Email threading](/service-desk/email-threading/)
- [Suspended mail](/service-desk/suspended-mail/)
- [Troubleshoot a support mailbox](/service-desk/mailbox-health/)
- [Ticket notification emails](/service-desk/ticket-notifications/)
- [Tickets](/service-desk/tickets/)
- [Queues and canned responses](/service-desk/queues-and-automation/)
- [Configure outgoing email](/depot/email/)