> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atako.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Email

> Give your agent its own inbox — receive, reply, and cold-send with built-in protection and approval gates.

The email channel gives an agent a real, working inbox: a dedicated address it can receive at and send from, with a pipeline of protections on the way in and approval gates on the way out.

## Dedicated address

When you activate the email channel on an agent, it's assigned its own permanent address, shown at the top of the agent's Email tab.

This address is generated once and never reassigned — even if the channel is later disabled, the address stays tied to that agent. Anyone can email it; what happens next depends on the protections below.

## Receiving email

Every inbound message passes through a protection pipeline before it ever reaches the agent:

<Steps>
  <Step title="Deduplication">
    Messages already seen (same sender, same message) are recognized and skipped — retries from a mail server never create duplicate work.
  </Step>

  <Step title="Blocked-sender filtering">
    Senders you've denylisted, or addresses that have previously hard-bounced, are dropped silently.
  </Step>

  <Step title="Auto-reply detection">
    Out-of-office and other automated replies are recognized and stored, but they never wake the agent — so a "Re: Re: Re:" chain with an autoresponder can't loop.
  </Step>

  <Step title="Quarantine checks">
    A message is held in quarantine — visible and recoverable from the UI, but not delivered to the agent — if any of the following apply:

    * the sender policy is set to **allowlist** and the sender isn't on it
    * the sender has exceeded the rate limit (default **10 messages/hour** to this agent)
    * the message fails DMARC authentication
  </Step>

  <Step title="Delivered to the agent">
    Everything that clears the checks above reaches the agent as a normal work item, queued for delivery even if the agent is momentarily offline.
  </Step>
</Steps>

<Note>
  Quarantined messages aren't lost — they remain visible in the agent's Email tab.
</Note>

### Content handling

* **Attachments** are accepted up to **15 MiB**.
* **HTML emails** are converted to plain text before the agent sees them.
* **External content is never trusted automatically.** Everything that arrives by email — including attachment content — is presented to the agent as untrusted input, so a malicious email can't smuggle in instructions the agent would otherwise follow.

## Sending email

### Sender policy

Controls who is allowed to email this agent in the first place:

| Policy           | Behavior                                                                                                |
| ---------------- | ------------------------------------------------------------------------------------------------------- |
| `open` (default) | Anyone can email the agent's address                                                                    |
| `allowlist`      | Only addresses and domains you've explicitly allowed can reach the agent — everyone else is quarantined |

### Cold-send mode

A "cold send" is an outbound email to an address that isn't already part of an existing conversation with the agent — in other words, the agent reaching out first. This is controlled separately from replies, since it carries more risk:

| Mode                 | Behavior                                                                   |
| -------------------- | -------------------------------------------------------------------------- |
| `approval` (default) | Cold sends are queued for a human to review and approve before they go out |
| `auto`               | Cold sends go out immediately, without review                              |
| `disabled`           | The agent can only reply within existing conversations, never initiate one |

<Warning>
  Switching cold-send to `auto` removes the human checkpoint on the agent's first contact with a new recipient — the UI surfaces a warning when you select it. Reserve it for agents whose outbound reach you're confident in.
</Warning>

Replies inside an existing thread aren't affected by cold-send mode — they always go out directly, subject to the daily quota below.

### Allowlist and denylist

Independent of the sender policy, you can maintain explicit lists of addresses and domains:

* **Allowlist** — required for inbound when sender policy is `allowlist`; also usable to pre-clear cold-send recipients
* **Denylist** — senders and domains that are always blocked, regardless of sender policy

Both are managed as editable chips in the agent's Email tab.

### Daily send quota

Outbound email is capped at a daily quota, shown in the Email tab and defaulting to **50 emails/day** per agent. The quota counts messages that were actually sent — not ones held for approval or rejected.

## AI-transparency footer

Every outbound email automatically includes a footer disclosing that it was sent by an AI agent, identifying the operating company and how to reach a human. This footer is added server-side to meet regulatory transparency requirements and **cannot be turned off**.

## Disabling the channel

Disabling email from the agent's danger zone stops the address from accepting new mail and blocks further sends. Conversation history is preserved — nothing is deleted — and reactivating later restores the same address with its full history.

## See also

* [Channels overview](/channels/overview) — principles shared across all channels
* [Webhooks](/channels/webhooks) — for structured events instead of free-form email
* [Activity](/guides/activity) — every inbound email appears in the timeline tagged with the email badge