# Email Sending The Email Sending page (**Settings → Email Sending**) is where you configure both **outbound** sending and **inbound** ingestion for your tenant. The page is split into two parts. ## Sending domains Karmaflow.ai sends outbound email from one or more verified sending domains (a subdomain you own, such as `mg.yourcompany.com`). Each domain card walks you through three checks: - **DNS verified** — SPF and DKIM records are in place - **Sending key generated** — credentials are ready - **Webhooks configured** — delivery, open, click, and bounce events flow back to Karmaflow.ai A domain only shows **Ready to Send** when all three are green. Click **Add a sending domain** to start a new one; the page prompts you through each step. ### Tracking Per-domain tracking covers opens, clicks, and unsubscribes. Tracking domains use a TLS certificate that the page can generate and renew for you. If a tracking option is off, those events won't be recorded for that domain. ## Inbound email Below the sending domains is the **Inbound email** section. Karmaflow.ai gives every tenant a unique address that you can route mail to — incoming messages are automatically attached to a contact (creating one if the sender is new) and become available for orchestration triggers. ### Your inbound ingest address The address shown in the **Inbound ingest address** card is unique to your tenant and looks like: ``` @sys.karmaflow.ai ``` This address is what Karmaflow.ai listens on. Your external senders should never see it. Instead, you set up an **alias, mailing list, or distribution group** on your own domain that delivers to it — so people email `support@yourcompany.com` and it lands in Karmaflow.ai without `sys.karmaflow.ai` appearing in headers, replies, or directories. ### Two ways to use it 1. **As a routing destination.** Configure an alias / Google Group / Microsoft 365 distribution list at the address you want public-facing (e.g. `support@yourcompany.com`) and add the ingest address as a member or destination. External senders interact with your domain only; Karmaflow.ai receives a copy of every message. 2. **As a BCC target.** When you reply from your own mailbox, BCC the same address. Karmaflow.ai logs the outbound message against the recipient's contact so the timeline shows both sides of the conversation. No alias setup needed for this use. ### How to point your own address at the ingest address Expand the **How to point your own address here** accordion on the settings page and pick your provider. The goal in every case is the same: an address on your own domain whose delivery target is the ingest address. - **Google Workspace (Gmail)** — best path is a Google Group at the public address (e.g. `support@yourcompany.com`). Add the ingest address as a group member. Set the group's "Who can post" to allow external senders. Mail to `support@yourcompany.com` silently fans out to Karmaflow.ai (and any human members you add). Admin alternative: Apps → Google Workspace → Gmail → Routing → recipient-rewrite rule that adds the ingest address as an envelope recipient. - **Microsoft 365 / Exchange** — create a Distribution List or Microsoft 365 Group at the public address, add the ingest address as a member. In Exchange admin center, set Delivery management on the group to allow senders inside and outside your organization (otherwise DLs reject external mail by default). Alternative: Mail flow → Rules → redirect or BCC matching messages to the ingest address. - **cPanel / Fastmail / DirectAdmin / hosted IMAP** — use the native Aliases / Forwarders feature. Create an alias whose source is `support@yourcompany.com` and destination is the ingest address. If you want a local copy retained too, list a second destination. - **Custom MX delegation** — for tenants that want a whole subdomain (e.g. `mail.yourcompany.com`) to land in Karmaflow.ai at the DNS level. Rarely needed; contact support if you think you do. #### Catch-all routing For tenants who want every unrouted address at their domain (`*@yourcompany.com`) to flow into Karmaflow.ai, set up a **catch-all** alias / forwarder pointing at the ingest address. Great for typos and "anything goes" inboxes, but also catches bounce backscatter — pair with the pre-filter agent (described below) to drop spam. After any setup, send a test from outside your domain. Within a minute it should appear under the matching contact's Communications view. ### What happens when an email arrives 1. **Sender matched.** If the sender's email already belongs to a contact, the email is attached to that contact. 2. **Sender unknown, company recognized.** If the sender's domain matches an existing company, a new contact is created and linked to that company. 3. **Sender fully unknown.** A new contact is created. For corporate domains the company is created at the same time. Public mailbox domains (Gmail, Outlook, iCloud, Yahoo, etc.) only create the contact — no company is created from a Gmail address. 4. **Activity logged.** An `email_received` entry appears on the contact's (and, if applicable, the company's) timeline. 5. **Orchestrations fire.** The event `email.inbound_received` is dispatched, so any orchestration with a matching trigger runs. Duplicate messages (same `Message-ID`) are detected and skipped, so a forwarding loop or re-delivery won't create duplicate timeline entries. ### Ingestion behavior The **Ingestion behavior** card controls how inbound messages are handled before they're stored: - **Default owner for auto-created contacts.** Picks the user assigned to any contact or company that the inbound pipeline creates. Defaults to unowned (visible to everyone). - **Pre-filter agent (optional).** A task agent that inspects each inbound message before it's persisted. The agent's job is to return JSON: `{"action":"allow"}` to let the message through, or `{"action":"drop"}` to discard it (useful for spam, vendor noise, or bounce backscatter). Anything else — including a timeout, an error, or unparseable output — falls back to **allow** so legitimate mail is never silently lost. Pre-filter is off by default. - **Pre-filter timeout.** How long to wait for the agent before defaulting to allow. Range 1,000–60,000 ms; default 10,000. The **Mailgun route active** badge above the form confirms that the routing infrastructure is provisioned for your tenant. It appears automatically the first time the settings page loads; no manual setup is needed. ## Related - **Notifications** — configure the sender identities used by transactional and system email. - **Group Inboxes** — set up shared team mailboxes with their own dedicated addresses for support and sales triage.