Agent email

When an agent’s AGENT.md has the Email ability enabled, Fontana creates its mailbox address on the same inbound domain as Email Import once the file syncs; there is no separate provisioning step. Built-in email tools let the agent list, search, read, draft, and send. Inbox, outbox, drafts, and deleted are folders under the package’s mailbox/ folder in Fontana Files, and appear in the Agents explorer. Built-in agents such as Echo get a mailbox the same way.

What is an agent mailbox?

A tenant address of the form {slug}@<tenant>.<baseDomain> (for example reports@acme.example.com). Inbound SMTP stores each message as MIME in the agent’s mailbox folders in Fontana Files. Outbound send uses Fontana’s dedicated mail path for agent mailboxes, separate from Admin identity SMTP used for account notifications.

Email on the agent card

Open the agent and expand Email under Abilities. The card uses the same Enabled switch as the other abilities. Inside, Receive and Send are separate rows, with the mailbox address above them.

Control	What you set
Mailbox address	The address people use to write to this agent. Copy it from the tile. Turning Email on, or Receive or Send on, creates the address when inbound mail is configured.
Receive	Lets the agent list, search, and read its mailbox. Turning this off leaves stored mail in place, and an email_received schedule can still start a turn.
Send	Lets the agent draft and send to one or more To, Cc, and Bcc recipients. Every recipient must match the send whitelist. An empty send list blocks every outgoing message. Bcc addresses travel in the delivery envelope only and never appear in the message other recipients receive. Outgoing bodies may be markdown, which Fontana sends as HTML with a plain-text alternative. Every send is audited.
Receive whitelist	One sender pattern per line, such as *@acme.com. An empty list allows every sender. When the list has patterns, the agent only sees mail from matching addresses.
Send whitelist	One recipient pattern per line. An empty list blocks every send.

Whitelists are saved with the agent. The mailbox tools enforce them.

Schedules

On the agent Schedules tab you can add an email_received event (no workflow id). Delivery always writes the message to the VFS inbox. A chat turn starts only when that schedule exists and your personal activation is On. See Agent schedules.

When someone replies to a message this agent sent from a chat, the reply continues that chat: a system message states that a reply arrived, with the sender, subject, mailbox path, and the plain-text body, and the agent’s turn runs on that thread. A correlated reply does not start the email_received schedule. Mail that is not a reply to something this agent sent starts the schedule with only the new message.

When the chat is working on Exception Management tickets, the agent names the tickets this message is about. History on those tickets records the sent email and the reply. Fontana stores the chat context and the agent’s note beside the sent message in the mailbox. The message itself carries a Message-ID, which is how a reply is matched back to that send and those tickets. See Exception Management.

Outbound delivery: direct or SMTP relay

Agent From uses the inbound mailbox domain (<tenant>.<baseDomain>). In Admin → Email you choose how those messages leave your deployment:

Mode	What happens
Direct (default)	Fontana’s own outbound mail server signs each message with DKIM and delivers it to the recipient’s mail server itself. No third-party mail account is required. You publish the DNS records below and your hosting account must allow outbound SMTP on port 25.
SMTP relay	You save a provider’s submission host, user, and password (for example Amazon SES SMTP, Mailgun, or Postmark). Fontana stores them in Vault and submits agent mail to that provider over TLS (STARTTLS on 587, implicit TLS on 465). Clear the relay to return to direct delivery.

The Send test field on the same card sends one message from agent-mail-test@<tenant>.<baseDomain> through the active mode so you can confirm delivery and inspect the receiver’s Authentication-Results header.

DNS: SPF, DKIM, and DMARC for agent From

The Sender DNS card in Admin → Email shows each TXT record name, the value to publish, and what public DNS currently returns:

1. Point MX for your tenant mail hostname at the host your platform team provisions for inbound mail.
2. Publish SPF on the mailbox domain (<tenant>.<baseDomain>) naming your deployment’s sending IP; add the provider’s include: when you use a relay.
3. Publish the DKIM TXT at <selector>._domainkey.<baseDomain>. Fontana generates the signing key during deployment and shows the exact value in the DNS card; one key signs every tenant subdomain.
4. Publish DMARC at _dmarc.<tenant>.<baseDomain> with relaxed alignment (adkim=r; aspf=r) so the DKIM signature on the base domain aligns with tenant subdomain From addresses.

For direct delivery, your platform team also gives the sending IP a forward hostname and matching reverse DNS (PTR); the deployment tooling provisions both for AWS-hosted environments.

Identity SMTP (Admin → Email → Identity email, account notification mail such as password reset) is a separate From path. Do not reuse those credentials for agent mailboxes.

Enable inbound and outbound together

Your platform team enables inbound and outbound agent mail together during deployment (fontana apply). See Hardware requirements for capacity, and Email Import for the operator enable path.