> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xpander.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Email

> Two email paths: transactional mail xpander sends (sign-in codes, notifications, approvals) and the inbox an agent can have; what each needs on cloud and on a self-hosted install.

## Transactional email

xpander sends sign-in codes, notifications about finished or failed runs, approval requests, and the mail an agent sends with its send-email action.

| Deployment            | Delivery                                                                                                                                                                                                                                                                                                                                               |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| xpander cloud         | xpander's own SendGrid and Mailgun accounts                                                                                                                                                                                                                                                                                                            |
| Hybrid and Air-Gapped | Your SMTP relay, one block in the chart: `global.smtp.host`, `port` (587), `starttls`, `user`, `passwordSecret.name` and `.key` (a Secret you create), `adminEmail` and `senderName`. It feeds sign-in mail, invitations and xpander's own notifications from one place, rendered into `XPANDER_EMAIL_DELIVERY`. No mail leaves the cluster to xpander |

On Amazon SES, a new account is in the sandbox and delivers only to verified addresses; request production access before inviting members, and create the DKIM, MAIL FROM and DMARC records SES gives you. Without SMTP configured, the login page's email-code flow still works: the code is generated and stored, just not sent. Print it from the cluster:

```bash theme={"dark"}
bash scripts/get_login_code.sh <email> <namespace>
```

Notification settings per agent (on success, on error) are on [Budgets and notifications](/use/agents/budgets).

## An inbox for an agent

On xpander's cloud, the **Email** switch on an agent's Channels pane gives it an address of the form `<agent-name>@xpander.bot`. Anything emailed or forwarded to it, messages, threads and files, becomes a run, attributed to the sender. **Reply to newsletters** (off by default) decides whether mailing-list mail gets an answer emailed back; the run happens either way.

On xpander's cloud the inbound gateway is xpander's. A self-hosted installation can run its own mailboxes: every agent gets `<handle>@<your reply domain>`, and the API accepts the mail at `POST /v1/inbound/email?token=<INBOUND_EMAIL_TOKEN>` in the Mailgun store-and-notify shape, checking the token and the Mailgun signature. Set on the chart:

```yaml theme={"dark"}
api:
  env:
    INBOUND_EMAIL_REPLY_DOMAIN: agents.xpander.acme.example   # the agents' address domain
  extraEnv:
    - name: INBOUND_EMAIL_TOKEN        # from a Secret you create
    - name: MAILGUN_SIGNING_KEY        # from the same Secret
ui:
  env:
    VITE_EMAIL_DOMAIN: agents.xpander.acme.example
```

With Mailgun, point a route for the domain at the endpoint. On AWS, receive with Amazon SES into an S3 bucket, and post each object to the endpoint from a small job in the cluster. Two SES facts cost time when missed. First, Amazon SES supports receiving only in specific regions; when the cluster's region does not support it, the receiving rule and its bucket must live in one that does. Second, the bucket policy must grant SES with `aws:SourceAccount`, not the legacy `aws:Referer`, or SES bounces the mail silently. The channel list on a self-hosted installation is on [Channels](/use/agents/channels#organization-switches).

<Frame caption="Settings > Channels on a licensed installation: Slack, Microsoft Teams, Email and MCP as organization-wide switches. Shown with sample data.">
  <img src="https://mintcdn.com/xpanderai-099931d1/OdLxX9OyFVicAV0l/images/verify/channels-1.png?fit=max&auto=format&n=OdLxX9OyFVicAV0l&q=85&s=63787e13614396371aac9cbf5b5477d0" alt="Settings Channels list" width="1440" height="900" data-path="images/verify/channels-1.png" />
</Frame>

## Egress on a self-hosted install

Outbound mail goes only to the relay you configured. The hosts `mailgun.net` and `sendgrid.com` appear in the egress allowlist for xpander cloud; a self-hosted install needs neither.