Guides
Email providers
By default sign.yt sends invitations and notifications through its managed email service. Organizations can switch to their own provider so emails come from their domain.
The email provider is configured by an organization admin in the app (Settings, Email). It is not exposed to API keys. Documents sent through the API use the organization's configured provider automatically.
Providers#
| Provider | What you provide |
|---|---|
| Managed (default) | Nothing. Emails are sent by sign.yt. |
| SMTP | Host, port (25, 465, 587 or 2525), username, password, TLS. Works with Microsoft 365, Google Workspace and most mail servers. |
| Microsoft Graph | Microsoft 365 tenant app credentials and the mailbox to send as. |
| Resend (your account) | Your Resend API key and a domain verified in Resend. |
| Amazon SES | Access key, secret, region and a verified sender address. |
| Mailgun | API key and sending domain. |
Secrets such as SMTP passwords and API keys are stored encrypted.
DNS: SPF, DKIM and DMARC#
The Email settings page lists the records your domain needs for the selected provider and has a check button that looks them up and shows which are missing:
- SPF: an include for the provider (for example
include:amazonses.comfor SES and Resend,include:mailgun.orgfor Mailgun,include:spf.protection.outlook.comfor Microsoft). - DKIM: the keys published by your provider (fetched from SES, Mailgun or Resend where possible).
- DMARC: a policy record; the suggested starting point is
v=DMARC1; p=none; rua=mailto:dmarc@<your domain>.
Throughput and bounces#
- Large campaigns are throttled per hour depending on the provider (higher for API-based providers than for SMTP).
- Bounces and spam complaints for managed email mark the recipient as
BOUNCEDand emitrecipient.bounced.