Dedicated address
When you activate the email channel on an agent, it’s assigned its own permanent address, shown at the top of the agent’s Email tab. This address is generated once and never reassigned — even if the channel is later disabled, the address stays tied to that agent. Anyone can email it; what happens next depends on the protections below.Receiving email
Every inbound message passes through a protection pipeline before it ever reaches the agent:1
Deduplication
Messages already seen (same sender, same message) are recognized and skipped — retries from a mail server never create duplicate work.
2
Blocked-sender filtering
Senders you’ve denylisted, or addresses that have previously hard-bounced, are dropped silently.
3
Auto-reply detection
Out-of-office and other automated replies are recognized and stored, but they never wake the agent — so a “Re: Re: Re:” chain with an autoresponder can’t loop.
4
Quarantine checks
A message is held in quarantine — visible and recoverable from the UI, but not delivered to the agent — if any of the following apply:
- the sender policy is set to allowlist and the sender isn’t on it
- the sender has exceeded the rate limit (default 10 messages/hour to this agent)
- the message fails DMARC authentication
5
Delivered to the agent
Everything that clears the checks above reaches the agent as a normal work item, queued for delivery even if the agent is momentarily offline.
Quarantined messages aren’t lost — they remain visible in the agent’s Email tab.
Content handling
- Attachments are accepted up to 15 MiB.
- HTML emails are converted to plain text before the agent sees them.
- External content is never trusted automatically. Everything that arrives by email — including attachment content — is presented to the agent as untrusted input, so a malicious email can’t smuggle in instructions the agent would otherwise follow.
Sending email
Sender policy
Controls who is allowed to email this agent in the first place:Cold-send mode
A “cold send” is an outbound email to an address that isn’t already part of an existing conversation with the agent — in other words, the agent reaching out first. This is controlled separately from replies, since it carries more risk:
Replies inside an existing thread aren’t affected by cold-send mode — they always go out directly, subject to the daily quota below.
Allowlist and denylist
Independent of the sender policy, you can maintain explicit lists of addresses and domains:- Allowlist — required for inbound when sender policy is
allowlist; also usable to pre-clear cold-send recipients - Denylist — senders and domains that are always blocked, regardless of sender policy
Daily send quota
Outbound email is capped at a daily quota, shown in the Email tab and defaulting to 50 emails/day per agent. The quota counts messages that were actually sent — not ones held for approval or rejected.AI-transparency footer
Every outbound email automatically includes a footer disclosing that it was sent by an AI agent, identifying the operating company and how to reach a human. This footer is added server-side to meet regulatory transparency requirements and cannot be turned off.Disabling the channel
Disabling email from the agent’s danger zone stops the address from accepting new mail and blocks further sends. Conversation history is preserved — nothing is deleted — and reactivating later restores the same address with its full history.See also
- Channels overview — principles shared across all channels
- Webhooks — for structured events instead of free-form email
- Activity — every inbound email appears in the timeline tagged with the email badge