Add the mailbox
Friendly name and email, host / port / security, the folder to watch and the department it feeds, then hit Test for a real IMAP login before saving.
Email channel · piped + grounded
Every email, answered and tracked.
Connect support@, billing@ or an outreach reply inbox and tell each mailbox its job. Support mail becomes a native ticket, CRM replies stay in CRM, automated mail is filtered before it becomes work, and OpsIQ drafts or sends grounded replies on the right thread. Transactional and broadcast email use the same authenticated delivery layer.
Tickets or CRM-onlyAI drafts, you approveA–F domain diagnosticsNo MX change to start
Inbound mail becomes a ticket
AI drafts the reply in your voice
Live
A real email help desk
One inbox, one timeline.
1inbox → one threaded timeline
DKIMsigned on every message
AIdrafts replies in your voice
2mailbox purposes: tickets or CRM-only
📬 Connect your mailbox
Point support@ at OpsIQ in minutes.
Add an IMAP mailbox (Gmail, Outlook or cPanel), give it a friendly name, route it to a department, and test the connection with a real login before you save. Or set a forwarding rule from support@ to your OpsIQ pipe address. A cron job polls every few minutes; no MX change required to get started, and you can run sales@, billing@ and support@ side by side, each routed.
IMAP mailboxConnected
Routes by recipientsupport@ · sales@ · billing@
Choose the way in
IMAP credentials to fetch on a schedule, or a forwarding rule from support@ to your pipe address. Either way, no MX change to start, and many mailboxes run side by side.
OpsIQ polls & routes
A cron job checks every enabled box on each tick, or Poll now on demand. Every message from a box lands on the right queue.
Mailbox control plane
Every mailbox knows what work it owns.
Choose support tickets or CRM replies only. Then route the message, notify the people (not the inbound address) and stop newsletters, bounces and automated senders before they pollute the queue.
MAILBOX PURPOSE
Routing enabledSupport tickets
1 · RECEIVECustomer requestIMAP · INBOX · Message-ID kept
2 · ROUTENative ticketBilling department · threaded
3 · NOTIFY3 team membersPrimary admin is the safe fallback
Department address protectedNotifications go to active department members, never back into the polled mailbox.
Support becomes accountable work.
Create and thread native tickets, preserve attachments and route by recipient or department policy.
Outreach replies stay in CRM.
A dedicated CRM-only mailbox tracks matching replies without creating tickets or sending automatic replies.
Direct mailbox threads can still answer.
Mailbox mode can queue, draft or send a grounded reply and stands down after human takeover.
📥 Inbound → native ticket
Every support request becomes a native ticket.
Once a mailbox is set to Support tickets, the ingestor reads an eligible human message, resolves the sender to a contact, opens the ticket and carries attachments inline. Follow-ups thread onto the same ticket. CRM-only and automated mail remain outside the queue by design.
Thread matching & attachments
Replies land on the right ticket.
Message-ID, In-Reply-To and References headers (plus the requester) are matched so a customer's reply appends to the original ticket. Attachments (receipts, screenshots, PDFs) are decoded from multipart MIME and stored on the timeline.
- Sender resolved. Matched to an existing contact or created automatically.
- Header threading. In-Reply-To / References append instead of duplicating.
- Attachments ingested. Files travel into the ticket, not a separate inbox.
- Routing & SLA. Rules auto-assign and the first-response clock starts at once.
Live
🧵 Message-ID minting & idempotency
One message, one ticket, guaranteed.
Every outbound message gets a minted, persisted Message-ID. When a reply returns, OpsIQ matches In-Reply-To and References against that ID, so the follow-up appends to the original ticket instead of opening a duplicate. An atomic Message-ID claim makes ingestion idempotent, even if the poll runs twice.
- Message-ID minted & persisted. Stored, then matched on reply.
- In-Reply-To / References headers preserved both directions.
- Atomic idempotency claim. A double poll never double-ingests.
- Requester fallback. Matched to the contact when headers are stripped.
Live
AI email replies · grounded
Grounded answers, in your voice.
The same brain that runs your chat widget reads the email, answers from your knowledge base and the customer's account, and either drafts a reply for an agent to approve in the Email Drafts queue or sends it automatically, your choice, per workspace. Each inbound message lands with a grounded draft attached: tweak it inline, hit Regenerate for a fresh take, or approve to send. RFC-3834 suppression skips auto-responders, bounces and no-reply senders, and a 3-per-hour per-sender cap stops reply loops dead.
Grounded in account + KB. Answers from real data, refuses to invent facts.
Edit · regenerate · approve. Nothing reaches the customer until you choose to; auto-send is opt-in per workspace.
Suppression & rate limit. RFC-3834 never auto-replies to daemons; a per-sender cap kills loops.
Approvethen send, your call
OpsIQ Writingalso drafts broadcasts
Groundedaccount + KB, never invents
Approve-firstor auto-send, per workspace
Loop-safeRFC-3834 + 3/hour cap
✅ Deliverability
Signed, aligned, and in the inbox.
Outbound email leaves through one transport you control: pin a Mailgun / SendGrid / Postmark / Resend / Amazon SES connector, or configure SMTP as the fallback. Every message is DKIM-signed and SPF/DMARC-aligned for your domain, so mailbox providers trust it. A 24-hour delivery panel shows sent, failed and a breakdown by transport, with a warning if OpsIQ is still falling back to PHP mail().
Pinned connector: Mailgun, SendGrid, Postmark, Resend, Amazon SES.
SMTP fallback over STARTTLS / SSL, used if the connector send fails.
24h delivery stats: sent, failed and a by-transport breakdown.
Send a test email to verify the transport end to end before going live.
Live
Deliverability lab
Grade the domain. Fix the exact record.
Run a read-only DNS diagnosis across SPF, DKIM and DMARC, see whether MX is present, and get copy-ready records for every gap. Beside it, the original designed email stays intact inside a sanitized, script-free sandbox that sizes itself to the message.
B78 / 100
AUTHENTICATION GRADE
One record from excellent.
Weighted from DMARC, SPF and DKIM, not a decorative score.
SPFPass · 4 of 10 DNS lookups
35 / 35DKIMNo common selector found
12 / 25DMARCp=quarantine · rua reporting on
40 / 40MX2 receiving hosts found · informational
PresentRECOMMENDED DNS CHANGEDKIM · TXT / CNAME
selector._domainkey.company.comPublish the exact selector supplied by your sending provider.
INBOUND HTML PREVIEW
Designed email, safely contained.
SanitizedNo scriptsAuto-height
Customer HTML cannot style the OpsIQ interfaceImages and tables remain responsive
🧭 Outbound router
One send path, every fallback covered.
Every outbound message (agent reply, AI auto-reply, transactional, broadcast) enters a single router. It tries your pinned connector first, then any other configured connector, then SMTP, and only falls through to PHP mail() as a last resort, warning you the moment it does. One deterministic path for CRM email, campaigns, proactive rules and ticket replies.
TransportPinned
Last resortPHP mail() · warned
Pinned first
Pin one connector as the preferred outbound default so every send is predictable: agent replies, AI auto-replies, transactional and broadcasts alike.
Cascade on failure
If that send fails, the router cascades to your remaining connectors, then SMTP, so a single provider outage never silences your support inbox.
Warn on fallback
Only if nothing else is set does it fall through to PHP mail(), and a warning fires the instant it does, because most hosts throttle it.
📨 Beyond support replies
From a single receipt to a whole audience.
Transactional email
Resets, 2FA codes, ticket updates, CSAT surveys and invoice receipts ride the same signed relay with branded HTML templates.
Broadcast composer
Compose with OpsIQ Writing, send to all active agents or a selected subset; every run logs date, subject, scope and sent / failed counts.
Consent & unsubscribe
Audience sends respect consent state; the unsubscribe link revokes consent and logs the activity automatically.
⚖️ How it compares
A serious email channel, not Gmail with labels.
Email Channel owns mailbox purpose, ingestion, replies, rendering and delivery. When a message needs formal case management, it hands the work to OpsIQ Ticket System with the original thread intact.
| Capability | Shared inbox / Gmail-as-helpdesk | OpsIQ |
|---|---|---|
| Mailbox purpose: tickets or CRM-only | Usually inbox-only | Per mailbox |
| Eligible support email → native ticket | Labels & threads, not real tickets | Built-in |
| Newsletter / daemon suppression | Manual filters | Header + sender guards |
| A–F SPF / DKIM / DMARC diagnosis | Separate tool / DIY | Exact fixes included |
| Sandboxed designed-email rendering | Varies | Sanitized + auto-height |
| AI drafts grounded in your KB + account | None / paid add-on | Core, included |
| Approve-then-send draft queue | Manual / partial | Edit · regenerate · send |
| Unified with chat + tickets + CRM | Inbox only | One workspace |
| Header thread matching (no dupes) | Threads, not tickets | Message-ID + idempotency |
| DKIM / SPF / DMARC handled for you | DIY DNS / partial | Relay + connectors |
| Transactional + broadcast on same relay | DIY / limited | One signed relay |
| Bounce & complaint tracking | Manual | Tracked + auto-skip |
| Bring your own provider (SES / Postmark…) | n/a / limited | Connector or SMTP |
| Pricing model | Per-seat / per-mailbox | Flat plan |
Full feature list
Everything in Email Channel.
Every capability, grouped. ★ marks a stand-out.
| Feature | What it does |
|---|---|
| Inbound | |
| IMAP Mailbox Connect ★ | Gmail, Outlook or cPanel; test the connection live before saving, cron polls every 3 minutes. |
| Per-Mailbox Purpose NEW | Choose Support tickets or CRM outreach replies only for every connected mailbox. |
| CRM-Only Reply Tracking NEW | Matching outreach replies stay on the CRM timeline and never create tickets or automatic replies. |
| Inbound Email → Native Ticket ★ | Eligible support mail resolves the sender, opens a ticket, adds the body as the first reply and carries attachments inline. |
| Automated Mail Suppression NEW | List-Unsubscribe, List-ID, bulk precedence, campaign headers, no-reply senders and mail daemons are skipped before ticket creation. |
| Safe Department Notification NEW | New-ticket alerts go to active department members or the primary admin, never back to the department's inbound mailbox. |
| Sendmail Pipe Receiver | Alias-pipe raw email straight into tickets via your MTA, no MX change required. |
| Header-Based Thread Matching ★ | Message-ID, In-Reply-To and References matched so replies thread instead of duplicating. |
| Inbound Idempotency NEW | Atomic Message-ID claim means a double poll never double-ingests the same email. |
| Attachment Ingestion | Decoded, stored and displayed inline from multipart MIME; files travel into the ticket. |
| Sanitized HTML Email Rendering NEW | Designed inbound email renders inside a script-free sandboxed iframe that auto-sizes; its CSS cannot leak into OpsIQ. |
| Department Routing by Recipient | support@, billing@ and sales@ routed by the To / Cc / Delivered-To headers into the right queue. |
| Multiple Mailbox Support | Multiple parallel mailboxes (plan-capped: 10 on Growth, up to unlimited on Enterprise): support@, sales@, billing@ side by side, each routed. |
| Polling Performance Budgeting NEW | Wall-clock budget plus per-mailbox caps so AI drafts never stall the poll. |
| IMAP Timeout Hardening NEW | 8–12s bounded timeouts; a dead host costs ~20s at most, never an unbounded stall. |
| SSL Certificate Validation Toggle NEW | Validated by default; self-signed certs are a per-mailbox opt-in. Secure by default. |
| AI & replies | |
| AI-Drafted Email Replies ★ | Grounded in the account and your knowledge base, written in your voice, mode set per workspace. |
| Email Drafts Queue ★ | A review page where every pending reply waits: approve-then-send. |
| Draft Regeneration NEW | Re-run the AI with the same context for a fresh take, without losing the thread. |
| Draft Editing NEW | Inline tweaks before send: quick edits, no separate composer. |
| Auto-Reply Mode Control ★ | Auto-send, draft-first or hands-off, chosen per workspace. |
| Mailbox-Mode Auto Reply NEW | Direct mailbox threads can queue, draft or send without opening a ticket; human takeover and per-thread caps still apply. |
| Auto-Reply Suppression (RFC 3834) ★ | Skips mailers, bounces, no-reply senders and lists; never auto-reply to a daemon. |
| Per-Sender Auto-Reply Rate Limit NEW | 3-per-hour cap per sender stops reply loops from broken filters. |
| Outbound & deliverability | |
| Outbound Email Router ★ | One send path: pinned connector → other connectors → SMTP → mail() last resort. |
| Email Connector: Mailgun | Inbound webhook plus the Messages API for outbound relay. |
| Email Connector: SendGrid | Inbound Parse plus outbound over Basic Auth. |
| SMTP Fallback | STARTTLS or SSL used automatically when a connector send fails. |
| Test Email Send NEW | Fire a live test through the chosen transport to confirm delivery end to end. |
| DKIM Signing ★ | Per-message DKIM plus a unique Message-ID so providers trust your mail. |
| SPF & DMARC Alignment ★ | Relay and connector domains aligned so authentication passes. |
| A–F Domain Authentication Grade NEW | Read-only SPF, DKIM and DMARC diagnosis with recursive SPF lookup counting and informational MX detection. |
| Exact DNS Fix Records NEW | Copy-ready SPF, DKIM and DMARC host, type and value recommendations for every detected gap. |
| Per-Domain From Identity | Global or per-department From identity; connectors can override. |
| Reply-To Preservation ★ | In-Reply-To and References preserved so replies land on the same ticket. |
| Message-ID Minting & Persistence NEW | Minted, stored and matched against inbound replies. |
| Department Signatures NEW | Per-department signatures appended to outbound mail automatically. |
| Header Injection Defence ★ NEW | CRLF and NUL stripped from header values to block SMTP header injection. |
| Multipart MIME NEW | text/html plus attachments: text clients see text, HTML clients see styled. |
| Attachment Support NEW | Attach up to 15 files at 15MB each on outbound replies. |
| Analytics & logs | |
| 24-Hour Delivery Stats NEW | Sent and failed, broken down by transport, on a live 24-hour dashboard. |
| Email Audit Log ★ NEW | Every email logged with direction, status, transport and thread, fully auditable. |
| Transactional & broadcast | |
| Broadcast Email to Agents | Send to all or selected agents; every run is logged. |
| OpsIQ Writing for Broadcasts NEW | Compose broadcasts with the AI Assist writer. |
| Broadcast History & Audit NEW | Full history: who sent what, scope and sent / failed counts. |
| Transactional Email | Resets, 2FA codes, receipts, CSAT and ticket updates over the signed relay. |
| Compliance & suppression | |
| Email Consent Tracking ★ | unknown / granted / revoked states block mail to anyone opted out. |
| Unsubscribe Handling | The unsubscribe link revokes consent and logs the activity automatically. |
| Bounce Detection Activity | Hard bounces raise an email.bounced activity so you stop sending to bad addresses. |
| Bounce Impact on Outreach NEW | Bounced contacts are auto-skipped in sequences and outreach. |
| Integration, config & security | |
| Email Connector Context Provider NEW | Mailbox, draft, stats and domain config surfaced to the AI. |
| Pinned Connector Selection NEW | Pin one connector as the preferred outbound default. |
| Mail Fallback Warning NEW | Warns the instant OpsIQ has to fall back to PHP mail(). |
| Webhook Signature Verification ★ | HMAC-SHA256 or Basic Auth blocks forged inbound email. |
| Webhook Timestamp Validation NEW | A 5-minute window blocks replay attacks. |
| Unique Webhook Paths per Connector NEW | Unguessable per-connector paths prevent enumeration. |
| Allowed Self-Signed Certs (Per-Mailbox) NEW | Fine-grained opt-in for self-signed certs; secure by default. |
FAQ
Questions about the email channel.
Two ways: set a forwarding rule from support@ to your OpsIQ pipe address, or give OpsIQ IMAP credentials to fetch new mail on a schedule. Set its purpose to Support tickets and eligible customer requests start becoming tickets, with no MX change required.
Yes. Set that mailbox to CRM outreach. Matching replies are recorded on the CRM timeline, while the mailbox never creates support tickets or sends automatic replies. Use this for campaign and sequence reply addresses.
It performs read-only DNS checks for SPF, DKIM and DMARC, counts recursive SPF lookups against the RFC limit, reports MX for receiving context, and calculates a weighted A–F grade. Each gap includes the exact host, record type and copy-ready value needed to fix it.
Yes. Inbound HTML is sanitized and rendered inside a sandboxed iframe with scripts disabled. The frame auto-sizes to its content, images and tables stay responsive, links open separately, and the email's CSS cannot affect the OpsIQ interface.
Your choice, per workspace. You can have the AI auto-send grounded replies for confident answers, draft replies for an agent to approve in the Email Drafts queue, or stay silent and only suggest. Anything it isn't confident about is handed to a human with full context.
The relay DKIM-signs every outbound message and aligns SPF and DMARC for your sending domain. You add a couple of DNS records once; after that, mailbox providers authenticate your mail and it reaches the inbox. Bounces and complaints are tracked to protect your sender reputation.
No. OpsIQ matches Message-ID, In-Reply-To and References headers (and the requester) so a customer's reply appends to the original ticket. An atomic Message-ID claim makes ingestion idempotent, so even a double poll never double-ingests. New subjects from the same person open a new ticket only when they're genuinely a new request.
Your choice. Pin a Mailgun, SendGrid, Postmark, Resend or Amazon SES connector as the preferred transport, or configure SMTP directly. If a connector send fails, OpsIQ cascades to your other connectors then SMTP, and only falls through to PHP
mail() if neither is set, which the Email Settings screen warns you about, because most hosts cap it.Yes. Add multiple IMAP mailboxes (your plan sets how many: 10 on Growth, up to unlimited on Enterprise): support@, sales@, billing@, each with its own host, folder and the department it routes to. The cron poller checks every enabled box on each tick, and you can also "Poll now" or "Test" a mailbox on demand.
The same authenticated relay carries transactional mail (password resets, 2FA codes, ticket updates, CSAT surveys and invoice receipts) plus broadcasts to your agents or segmented audiences. Each broadcast is logged with its subject, scope and sent / failed counts, and audience sends honour consent and unsubscribe.
Yes. The poller works to a wall-clock budget with per-mailbox caps so a slow inbox never stalls the sync, IMAP timeouts are bounded to 8–12s, header values are stripped of CRLF and NUL to block injection, and inbound provider webhooks are verified by HMAC-SHA256 or Basic Auth with a 5-minute timestamp window and unguessable per-connector paths.