Send email from your own mailbox

By default, SafeHanded’s email to your users (secure links, one-time codes, notifications) comes from SafeHanded’s own address with your organisation’s name on it. If you’d rather it came from one of your own addresses, such as it-support@yourcompany.com, connect that mailbox under Settings → Integrations → Connect (Team and above). If your plan changes to Free, the connection is kept and mail goes from SafeHanded’s sender until you upgrade again.

If your mailbox is ever unavailable, SafeHanded falls back to its own sender, so mail is never lost.

Mail is always sent as the connected address: the From is the mailbox, with your organisation’s (or client’s) name on it, so your server accepts it and it passes DMARC.

One mailbox, or one per client

Your organisation has one mailbox, which sends everyone’s email. To use a different one (say, SMTP instead of Microsoft 365), edit or remove the current one first: SafeHanded won’t connect a second one beside it.

MSPs (on the MSP plan, in MSP mode) can also give each client its own mailbox, so that client’s staff get links from their own domain, e.g. it@clientco.com. When you connect a mailbox, choose who it sends for: Everyone (default mailbox) or one client. Each client can have one mailbox. Clients without one get the default; with no default, mail comes from the SafeHanded sender. You can change who a mailbox sends for later by editing it, if the new scope is free.

For a client’s Microsoft 365 mailbox connected with Microsoft, the sending address must be on a domain your organisation has verified, or on that client’s verified sender domain (under the client’s domains). SMTP and own-app connections use the client’s own credentials, so they don’t need a verified domain.

Not in use

A mailbox that never sends shows Not in use, with the reason:

• you set up more than one for the same scope before this rule existed: only the oldest sends, so remove the others or move them to a client;
• it’s a client’s mailbox and your organisation has moved off the MSP plan or out of MSP mode: client mailboxes stop sending and everyone’s mail goes through your one default mailbox. Moving back to the MSP plan brings them back.

Microsoft 365

You need:

• the sending address on a domain you’ve verified under Settings → Verification. SafeHanded only sends as addresses on domains your organisation has proven it owns;
• a Microsoft 365 account in the same organisation as the mailbox. The first time, an administrator (Global Administrator or Privileged Role Administrator) approves SafeHanded once.

1. Choose Connect → Microsoft 365 mailbox.
2. Give it a name and enter the sending address. A shared mailbox works well and needs no licence.
3. Select Connect with Microsoft and sign in with your work account.
4. If SafeHanded hasn’t been approved in your organisation yet, Microsoft asks an administrator to approve the Mail.Send permission. Approve it and you’re returned to SafeHanded.
5. SafeHanded checks the mailbox and sends you a test message from it. The connection shows Connected when it’s done.

You don’t need to find your tenant ID or register an app. SafeHanded reads your organisation from your Microsoft sign-in.

Limit SafeHanded to one mailbox (recommended)

Microsoft’s Mail.Send permission covers every mailbox in your organisation. SafeHanded only ever sends as the address you connected, but you can have Exchange enforce that. In Exchange Online PowerShell, put the mailbox in a mail-enabled security group and restrict the SafeHanded Mailbox app to it:

Connect-ExchangeOnline
New-DistributionGroup -Name "SafeHanded senders" -Type Security -PrimarySmtpAddress safehanded-senders@yourcompany.com
Add-DistributionGroupMember -Identity safehanded-senders@yourcompany.com -Member it-support@yourcompany.com
New-ApplicationAccessPolicy -AppId <SafeHanded Mailbox app ID> -PolicyScopeGroupId safehanded-senders@yourcompany.com `
  -AccessRight RestrictAccess -Description "SafeHanded may send only as it-support@yourcompany.com"

The app ID is on the Enterprise applications page in the Entra admin centre. A policy can take up to an hour to apply. After that, open the connection and choose Send test email. (Test connection only checks that the Mail.Send approval is in place, not the mailbox itself.)

Send test email. Any mailbox connection (Microsoft 365 or SMTP) has a Send test email button. It sends a real message through that connection to your own SafeHanded address, the same way your organisation’s notification email is sent.

Reconnect with Microsoft. If a connection says it needs reconnecting (for example, it was set up before this sign-in step existed, or an administrator removed the approval), open it and choose Reconnect with Microsoft. Until you do, mail goes from the SafeHanded sender.

Your own app registration (advanced). If your policy requires your own Entra app, tick Use my own app registration instead and enter your tenant ID, app (client) ID and client secret. The app needs the Microsoft Graph Mail.Send application permission, with admin consent.

SMTP server

Enter your server’s host, port, username and password, and the address to send from. Connections are always encrypted: choose STARTTLS (usually port 587) or TLS (usually port 465). If the server can’t encrypt the connection, SafeHanded won’t send through it. The server must be reachable from the internet.

Make sure it lands (SPF, DKIM, DMARC)

When mail comes from your own domain, the receiving server judges your domain’s reputation, not SafeHanded’s. A secure-link email from a domain without full email authentication is exactly what spam filters look for, and large providers such as Microsoft 365 often quarantine it rather than deliver it.

Before you rely on your own mailbox or SMTP server, check the sending domain has:

• SPF that includes your mail server, e.g. v=spf1 include:yourprovider.com ~all;
• DKIM signing turned on at your mail provider for that domain (usually a CNAME or TXT record they give you);
• DMARC, at least v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com to start, tightened to quarantine or reject once reports look clean.

Then press Send test email and send a real link to a colleague on a different email provider. If it’s held, your mail provider’s or recipient’s quarantine shows why. Microsoft 365 admins can release it and use Message trace to see what happened.

Publish these records where your domain’s DNS is hosted, which isn’t always your mail provider: if your provider generates a DKIM key but your DNS is at Cloudflare, say, add the TXT record there yourself (your provider tells you the record name, such as selector1._domainkey).

Microsoft 365 mailboxes connected with Microsoft are signed by Microsoft already, so they need only your domain’s usual SPF and DMARC.

Related

• Notifications
• Integrations overview