Communications

Goal: Let your workspace send email through a relay you control.

The window is titled Communications; its hero reads Email delivery. Under the hero, a strip says what the window does: "Outbound email goes out through an SMTP relay you already run or pay for; nothing here provisions a mail server, and no mail is routed through Fathym."

Before you start

• A connected cloud and a provisioned private landing zone. Until both exist the menu has no Communications. The landing zone is needed because the relay password is kept in its Key Vault.
• An SMTP relay you can authenticate to - a provider account, or a server you run.
• A sender address that relay is permitted to send as.

You do not need a verified domain or any Azure email resource.

The relay form

The Manual (SMTP Relay) tab holds the form:

Field	What it is
Send from	The address recipients see. Required. It must be a mailbox your relay is allowed to send as
Display name	The name shown beside the address. Optional
Relay host	The SMTP host your provider gave you. Required
Port	587 (the default; submission with STARTTLS) or 465 (implicit TLS). Port 25 is not offered: Azure blocks it
Encryption	starttls (the default) or implicit-tls. Match what your provider documents for the port
Relay username	The account the relay authenticates as. Required by the save
Relay password	Write-only. Stored in your landing zone's Key Vault and never shown again. The form asks for it on every save

The form lists every problem it finds above the button, and Save relay stays disabled until there are none.

The Cloud Email Services tab has no controls. It shows what is coming: Azure Communication Services and Amazon SES are Coming soon; Google Cloud reads Works today, through your own relay on the Manual tab.

Save relay

Save relay stores the relay settings and puts the password in your workspace's own Key Vault; the workspace record keeps only a reference to it. It sends nothing. On success:

Saved. The relay credential is stored in this workspace’s own key vault.

The save takes effect at once; it does not wait for Deploy. Communications cannot be removed from the workspace today.

Configured is not verified

"Configured and verified are two different facts. Only a real send proves the second." The banner at the top of the form says which you have:

Banner	Means
"A relay is configured and was last seen working."	The last verify connected and signed in to the relay
"A relay is configured and has not been tested yet."	The relay is stored; nothing has proved it works
The reason the last attempt failed	For example the relay rejected the credential, or could not be reached

The window has no test button. A relay is verified by a call to POST /ox-api/communications/verify, which connects and signs in to the relay with the stored credential, sends nothing, and records the result. That call, and sending mail with POST /ox-api/communications/send, need the Workspace.Communications.Send right.

Rights

Save relay checks no access right beyond being in the workspace. Verifying and sending need Workspace.Communications.Send.

Azi and agents

Azi and agents can propose only the sender Display name, a name and a description. The relay itself - host, port, encryption, username, sender address and password - is set by a person in this window and can never be proposed. The Communications menu item has no badge, and the window does not show proposals; accept them in Proposals.

Messages you may see

Code or place	Message
The form	A sender address, a relay host and the relay password are each required; a port other than 587 or 465 is refused
Refused by the save	"A relay username is required." or "A relay password is required the first time you configure email."
PRIVATE_LANDING_ZONE_REQUIRED	"This needs a private landing zone, which this workspace does not have yet."
DEPLOY_IN_PROGRESS	A setup window or a Deploy is already running for the workspace. Wait for it to finish, then try again
A failed save	The platform's reason, or "The relay could not be stored, and the platform did not report a reason."

Next steps

• The landing zone that holds the password -> Manage Private CALZ
• The order things unlock in -> Environment