> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atako.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Email

> Give your agent its own inbox — receive, reply, and cold-send with built-in protection and approval gates.

The email channel gives an agent a real, working inbox: a dedicated address it can receive at and send from, with a pipeline of protections on the way in and approval gates on the way out.

<Note>
  The email channel is available to general-purpose (Hermes) agents. Coding (opencode) agents don't have this channel — see [Engines](/concepts/engines).
</Note>

## Dedicated address

When you activate the email channel on an agent, it's assigned its own permanent address, shown at the top of the agent's **Mailbox** window — open the agent's panel on the [Floor](/guides/the-floor) and choose **Mailbox** under Channels (`/floor?agent=<agent-id>&channel=mailbox`).

This address is generated once and never reassigned — even if the channel is later disabled, the address stays tied to that agent. Anyone can email it; what happens next depends on the protections below.

## Receiving email

Every inbound message passes through a protection pipeline before it ever reaches the agent:

<Steps>
  <Step title="Deduplication">
    Messages already seen (same sender, same message) are recognized and skipped — retries from a mail server never create duplicate work.
  </Step>

  <Step title="Blocked-sender filtering">
    Senders you've denylisted, or addresses that have previously hard-bounced, are dropped silently.
  </Step>

  <Step title="Auto-reply detection">
    Out-of-office and other automated replies are recognized and stored, but they never wake the agent — so a "Re: Re: Re:" chain with an autoresponder can't loop.
  </Step>

  <Step title="Quarantine checks">
    A message is held in quarantine — visible and recoverable from the UI, but not delivered to the agent — if any of the following apply:

    * the sender policy is set to **allowlist** and the sender isn't on it
    * the sender has exceeded the rate limit (default **10 messages/hour** to this agent)
    * the message fails DMARC authentication
  </Step>

  <Step title="Delivered to the agent">
    Everything that clears the checks above reaches the agent as a normal work item, queued for delivery even if the agent is momentarily offline.
  </Step>
</Steps>

<Note>
  Quarantined messages aren't lost — they remain visible in the agent's Mailbox.
</Note>

### Content handling

* **Attachments** are accepted up to **15 MiB**.
* **HTML emails** are converted to plain text before the agent sees them.
* **External content is never trusted automatically.** Everything that arrives by email — including attachment content — is presented to the agent as untrusted input, so a malicious email can't smuggle in instructions the agent would otherwise follow.

## Sending email

### Sender policy

Controls who is allowed to email this agent in the first place:

| Policy | Behavior |
| - | - |
| `open` (default) | Anyone can email the agent's address |
| `allowlist` | Only addresses and domains you've explicitly allowed can reach the agent — everyone else is quarantined |

### Cold-send mode

A "cold send" is an outbound email to an address that isn't already part of an existing conversation with the agent — in other words, the agent reaching out first. This is controlled separately from replies, since it carries more risk:

| Mode | Behavior |
| - | - |
| `approval` (default) | Cold sends are queued for a human to review and approve before they go out |
| `auto` | Cold sends go out immediately, without review |
| `disabled` | The agent can only reply within existing conversations, never initiate one |

<Warning>
  Switching cold-send to `auto` removes the human checkpoint on the agent's first contact with a new recipient — the UI surfaces a warning when you select it. Reserve it for agents whose outbound reach you're confident in.
</Warning>

Replies inside an existing thread aren't affected by cold-send mode — they always go out directly, subject to the daily quota below.

### Allowlist and denylist

Independent of the sender policy, you can maintain explicit lists of addresses and domains:

* **Allowlist** — required for inbound when sender policy is `allowlist`; also usable to pre-clear cold-send recipients
* **Denylist** — senders and domains that are always blocked, regardless of sender policy

Both are managed as editable chips in the Mailbox settings.

### Daily send quota

Outbound email is capped at a daily quota, shown in the Mailbox settings and defaulting to **50 emails/day** per agent. The quota counts messages that were actually sent — not ones held for approval or rejected.

## AI-transparency footer

Every outbound email automatically includes a footer disclosing that it was sent by an AI agent, identifying the operating company and how to reach a human. This footer is added server-side to meet regulatory transparency requirements and **cannot be turned off**.

## Disabling the channel

Disabling email from the danger zone of the Mailbox settings stops the address from accepting new mail and blocks further sends. Conversation history is preserved — nothing is deleted — and reactivating later restores the same address with its full history.

## See also

* [Channels overview](/channels/overview) — principles shared across all channels
* [Webhooks](/channels/webhooks) — for structured events instead of free-form email
* [Activity](/guides/activity) — every inbound email appears in the timeline tagged with the email badge


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.