Four features send mail: address verification, password reset, member invitations and email alerts. They all go through one SMTP relay that you configure. Any provider with an SMTP interface works (Amazon SES, Postmark, SendGrid, Mailgun, Microsoft 365, your own Postfix). Without a relay, those features say so. Verification and reset answer 503 with mail_unavailable: true, and email alerts cannot be switched on. Invitations still work: the administrator is given the accept link to send.

​
1. Set the relay

On the API and the worker (the worker sends the mail; the API only queues it):
  • starttls requires the relay to offer STARTTLS. A relay that does not is refused, because silently falling back to plaintext is what an attacker on the path would arrange.
  • none is for a relay on the same host or network segment only, and is refused with a username and password outside development.
  • A half configuration (a password without a host, a host without SMTP_FROM) stops the process at startup, so a mistake shows up at deploy time rather than as mail that never arrives.
The relay host is operator configuration, so it may be on your private network. Nothing a tenant sends can change where mail is relayed.

​
2. Check delivery

Ask for a password reset for an account you control:
The answer is 202 whether or not the address has an account, so it does not tell you whether mail was sent. The mail should arrive within a few seconds. If it does not, look at the worker log for mail delivery failed. The line names the attempt and the relay’s answer, and never the recipient or the body. Failed sends are retried with backoff for about an hour.

​
What is sent, and what is kept

  • Verification: at signup, when a user asks from Settings → Profile, and when a sign-in is refused for an unverified address. At most one a minute.
  • Password reset: a link valid for 30 minutes and usable once. Using it ends every session the account had. Addresses whose organization requires single sign-on get no link, except an owner with a second factor (the break-glass).
  • Invitations: a link to the dashboard’s accept page.
  • Alerts: new critical or high findings on a scan, and failed policy verdicts, to the members chosen in Settings → Notifications. Slack is configured in the same place.
A queued message can hold a live link, so it is stored encrypted and deleted once it has been sent or has failed for good.

​
Try it locally

Mailpit catches mail without sending it:
Open http://localhost:8025 to read what was sent. In development with no SMTP_HOST, mail is written to the worker’s log instead.