Skip to main content

​
Email

One provider sends every platform email: verification and magic-link sign-in, password resets, invitations, alert notifications, operator notifications and — on the hosted service — the blog newsletter. A broken row here silences all of it, so this is the first integration a self-hosted deployment should configure. Scope: Global defaults. The Email card only appears under Global defaults, because the mailer is platform-wide: on KnoxCall Cloud it is KnoxCall’s provider, and on a self-hosted deployment it is yours. Workspaces do not configure an email provider — a workspace proves which addresses it may send as under Settings → Sending domains, and the platform provider does the sending. The detail view has three tabs: Credentials (this guide), Branding (logo and colours on the templates) and Templates (the wording). Before you start
  • Admin access to a provider account.
  • A sending domain you control, verified at the provider with SPF and DKIM. An unverified domain lands in spam or is refused outright; every provider below will show you the DNS records to publish.

​
1. Pick a provider and mint the credential

Pick one. Each section below gives the least-privilege credential and the KnoxCall fields it fills.

​
Resend

The default provider on KnoxCall Cloud, and the only one with newsletter and engagement features.
  1. resend.com → Domains → Add domain, publish the DNS records, wait for Verified.
  2. API Keys → Create API key. Permission Sending access, restricted to that domain. Full access is only needed if KnoxCall should also manage audiences (the newsletter features below).
  3. Copy the key (re_…) — shown once.

​
SendGrid

  1. SendGrid → Settings → Sender Authentication → authenticate your domain (DNS records).
  2. Settings → API Keys → Create API Key → Restricted Access → grant Mail Send only.
  3. Copy the key (SG.…) — shown once.

​
Postmark

  1. Postmark → Sender Signatures / Domains → add and verify the domain (DKIM + Return-Path).
  2. Open the Server that should send → API Tokens → copy a Server API token. Not the Account token — that manages servers and cannot send.

​
Mailgun

  1. Mailgun → Sending → Domains → Add New Domain (e.g. mg.your-domain.com), publish the DNS records, wait for verification. Note the region the domain was created in.
  2. API Security → Add new key (a sending key scoped to the domain is enough). Copy it — shown once.

​
Amazon SES

  1. SES console → Verified identities → Create identity → domain, with Easy DKIM. Publish the records and wait for Verified. If the account is still in the SES sandbox, request production access — the sandbox can only send to verified recipients.
  2. IAM → Users → Create user (no console access) with an inline policy allowing only ses:SendEmail and ses:SendRawEmail. Security credentials → Create access key → Application running outside AWS; copy both halves.

​
Custom SMTP

Any host that accepts authenticated submission — Google Workspace, Microsoft 365, Fastmail, a relay of your own.
  1. Create a dedicated mailbox or app password for KnoxCall that is allowed to send as your from-address. Do not reuse a person’s password.
  2. Note the host, port and TLS mode: port 587 with STARTTLS is the usual answer; 465 for implicit TLS.

​
2. Enter it in KnoxCall

  1. Settings → Integrations → Global defaults → Email → Configure.
  2. Choose the Provider at the top. The fields below change to match the tables above.
  3. Fill them in and Save credentials.
Switching provider later resets the credential fields — the old provider’s secret is not carried over — but shared settings such as the from-address and the admin notification email are kept.

​
3. Verify

Send yourself something real: Team → Invite a spare address, or sign out and request a magic link. Check both the inbox and the spam folder. A self-hosted deployment also shows a setup warning on the dashboard until a working email provider exists; that warning is answered by the same resolution the mailer uses, so it cannot say “configured” while sends are failing.

​
Things that bite

  • Required fields are enforced at send time, not save time. Each provider needs its own set (Mailgun needs the domain, SES the region, SMTP the host); a row missing one saves cleanly and fails on the first real send. Send that test email.
  • The from-address must be on the verified domain. Providers reject or silently drop anything else.
  • Resend engagement tracking rewrites links. Open and click tracking are per-domain settings in Resend; when click tracking is on, every link in every message from that domain — password-reset and magic-link URLs included — is rewritten through Resend’s redirect domain. If that is not acceptable, send credential mail from a second Resend domain with tracking off.
  • Corporate link scanners register as clicks. A recorded click is not proof a human clicked.
  • Workspace sends. Workflow email steps and alert notifications ride this provider too. A workspace may only send from a domain it has verified under Settings → Sending domains, or from a subdomain beneath one — never from a parent domain, and never from a KnoxCall-owned domain.