> ## Documentation Index > Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt > Use this file to discover all available pages before exploring further. # Email > Connect the email provider behind every KnoxCall email — Resend, SendGrid, Postmark, Mailgun, Amazon SES or any SMTP host — with the least-privilege credential for each, the fields to fill in, and how to prove mail is flowing. # Email One provider sends **every** platform email: verification and magic-link sign-in, password resets, invitations, alert notifications, operator notifications and — on the hosted service — the blog newsletter. A broken row here silences all of it, so this is the first integration a self-hosted deployment should configure. **Scope: Global defaults.** The Email card only appears under **Global defaults**, because the mailer is platform-wide: on KnoxCall Cloud it is KnoxCall's provider, and on a self-hosted deployment it is yours. Workspaces do not configure an email provider — a workspace proves which addresses it may send *as* under **Settings → Sending domains**, and the platform provider does the sending. The detail view has three tabs: **Credentials** (this guide), **Branding** (logo and colours on the templates) and **Templates** (the wording). **Before you start** * Admin access to a provider account. * A sending domain you control, verified at the provider with **SPF and DKIM**. An unverified domain lands in spam or is refused outright; every provider below will show you the DNS records to publish. ## 1. Pick a provider and mint the credential Pick one. Each section below gives the least-privilege credential and the KnoxCall fields it fills. ### Resend The default provider on KnoxCall Cloud, and the only one with newsletter and engagement features. 1. [resend.com](https://resend.com) → **Domains → Add domain**, publish the DNS records, wait for *Verified*. 2. **API Keys → Create API key**. Permission **Sending access**, restricted to that domain. *Full access* is only needed if KnoxCall should also manage audiences (the newsletter features below). 3. Copy the key (`re_…`) — shown once. | KnoxCall field | Value | | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **API key** | `re_…` | | **From address** | An address on the verified domain, e.g. `noreply@your-domain.com` | | **From name** | Shown as the sender, e.g. your product name | | **Admin notification email** | The inbox that receives internal operator alerts (new signups, partner applications) | | **Marketing webhook signing secret** *(optional)* | The signing secret of a Resend webhook pointed at `/webhooks/resend`, so unsubscribes and bounces flow back. Only for the newsletter. | | **Marketing segment ID**, **Blog topic ID**, **Newsletter from** *(optional)* | Newsletter settings. The feature stays **off** until both IDs are set, and the topic's default subscription **must be opt-in** or you will broadcast to people who never subscribed. | ### SendGrid 1. SendGrid → **Settings → Sender Authentication** → authenticate your domain (DNS records). 2. **Settings → API Keys → Create API Key** → **Restricted Access** → grant **Mail Send** only. 3. Copy the key (`SG.…`) — shown once. | KnoxCall field | Value | | -------------------------------- | ---------------------------------- | | **API key** | `SG.…` | | **From address** / **From name** | On the authenticated domain | | **Admin notification email** | Operator inbox for internal alerts | ### Postmark 1. Postmark → **Sender Signatures / Domains** → add and verify the domain (DKIM + Return-Path). 2. Open the **Server** that should send → **API Tokens** → copy a **Server API token**. Not the *Account* token — that manages servers and cannot send. | KnoxCall field | Value | | -------------------------------- | ----------------------------------------------------- | | **Server token** | The server API token | | **From address** / **From name** | On the verified domain | | **Message stream** | Usually `outbound` (the default transactional stream) | | **Admin notification email** | Operator inbox for internal alerts | ### Mailgun 1. Mailgun → **Sending → Domains → Add New Domain** (e.g. `mg.your-domain.com`), publish the DNS records, wait for verification. Note the **region** the domain was created in. 2. **API Security → Add new key** (a sending key scoped to the domain is enough). Copy it — shown once. | KnoxCall field | Value | | -------------------------------- | ------------------------------------------------------------------------------------------ | | **API key** | The sending key | | **Mailgun domain** | `mg.your-domain.com` | | **Region** | `us` (default) or `eu` — must match where the domain lives, or every send fails with a 401 | | **From address** / **From name** | On the Mailgun domain | | **Admin notification email** | Operator inbox for internal alerts | ### Amazon SES 1. SES console → **Verified identities → Create identity** → domain, with **Easy DKIM**. Publish the records and wait for *Verified*. If the account is still in the SES **sandbox**, request production access — the sandbox can only send to verified recipients. 2. IAM → **Users → Create user** (no console access) with an inline policy allowing only `ses:SendEmail` and `ses:SendRawEmail`. **Security credentials → Create access key → Application running outside AWS**; copy both halves. | KnoxCall field | Value | | ------------------------------------------------- | ----------------------------------------------------- | | **AWS access key ID** / **AWS secret access key** | The IAM user's key pair | | **AWS region** | The region of the verified identity, e.g. `us-east-1` | | **From address** | Must be on the verified identity | | **From name** | Sender name | | **Configuration set** *(optional)* | An SES configuration set for event tracking | | **Admin notification email** | Operator inbox for internal alerts | ### Custom SMTP Any host that accepts authenticated submission — Google Workspace, Microsoft 365, Fastmail, a relay of your own. 1. Create a **dedicated mailbox or app password** for KnoxCall that is allowed to send as your from-address. Do not reuse a person's password. 2. Note the host, port and TLS mode: port **587 with STARTTLS** is the usual answer; **465** for implicit TLS. | KnoxCall field | Value | | -------------------------------- | ---------------------------------------------------------------------- | | **Username** / **Password** | The submission account | | **Host** | e.g. `smtp.example.com` | | **Port** | `587` (STARTTLS) or `465` (implicit TLS) | | **Use TLS (true/false)** | `true` for 465; `false` for 587, where TLS is negotiated with STARTTLS | | **From address** / **From name** | An address the account may send as | | **Admin notification email** | Operator inbox for internal alerts | ## 2. Enter it in KnoxCall 1. **Settings → Integrations → Global defaults → Email** → *Configure*. 2. Choose the **Provider** at the top. The fields below change to match the tables above. 3. Fill them in and **Save credentials**. Switching provider later resets the credential fields — the old provider's secret is not carried over — but shared settings such as the from-address and the admin notification email are kept. ## 3. Verify Send yourself something real: **Team → Invite** a spare address, or sign out and request a magic link. Check both the inbox and the spam folder. A self-hosted deployment also shows a setup warning on the dashboard until a working email provider exists; that warning is answered by the same resolution the mailer uses, so it cannot say "configured" while sends are failing. ## Things that bite * **Required fields are enforced at send time, not save time.** Each provider needs its own set (Mailgun needs the domain, SES the region, SMTP the host); a row missing one saves cleanly and fails on the first real send. Send that test email. * **The from-address must be on the verified domain.** Providers reject or silently drop anything else. * **Resend engagement tracking rewrites links.** Open and click tracking are per-*domain* settings in Resend; when click tracking is on, every link in every message from that domain — password-reset and magic-link URLs included — is rewritten through Resend's redirect domain. If that is not acceptable, send credential mail from a second Resend domain with tracking off. * **Corporate link scanners register as clicks.** A recorded click is not proof a human clicked. * **Workspace sends.** Workflow email steps and alert notifications ride this provider too. A workspace may only send from a domain it has verified under **Settings → Sending domains**, or from a subdomain beneath one — never from a parent domain, and never from a KnoxCall-owned domain. ## Related * [Alerts](/monitoring/alerts) — email as an alert destination * [Workflows](/workflows/workflows-overview) — the email step