Scopes and Permissions

Control exactly which messages a credential can read and which addresses it can send from

Every managed credential combines a credential type, one or more verified-domain scopes, an IMAP access mode, and an SMTP sender policy. These settings answer two separate questions: which incoming messages are visible, and which sender addresses are allowed.

​

Credential types

Type	IMAP	SMTP	Intended use
mailbox	Available, subject to accessMode	Only with read_write access, subject to the sender policy	Email clients and applications that receive and send
smtp	Not available	Available, subject to the sender policy	Applications that only send

An SMTP-only credential still requires scopes and a sender policy. Its accessMode is always read_write so it can send, but this does not grant IMAP access.

​

Domain and address scopes

Each credential must include between 1 and 100 unique scopes. Every scope references the ID of an exact domain that your account owns and that has a verified domain record.

Scope type	Example	Incoming mail included
domain	*@example.com	Addresses on example.com
address	[e-mail]	Only [e-mail]

A domain scope matches the exact domain, not its subdomains. For example, *@example.com includes [e-mail], but does not include [e-mail]. To include mail.example.com, add that exact subdomain as its own verified domain record and configure a separate scope for it.

Address scopes must match their referenced domain exactly. Multiple distinct scopes can be combined, including scopes from different verified domains; duplicate scopes are rejected. Domain wildcard scopes omit the reserved dmarc@ address; add an explicit address scope if that address needs to be included.

A subdomain can inherit parts of its parent domain’s verification, but inheritance does not extend the parent’s mailbox scope. The exact subdomain must still exist as a separate verified domain record before it can be used as a login domain, sender domain, or scope.

​

How scopes appear in IMAP

A mailbox credential presents one combined INBOX containing incoming messages from all its scopes, plus a read-only folder for each individual scope:

INBOX
Scopes/*@example.com
Scopes/[e-mail]

Scopes is a folder container, not a selectable mailbox. Domain folders use the literal *@domain format; address folders use the complete email address.

Scope folders are always read-only, including for credentials with read_write access. Update flags or organize messages through INBOX or another writable folder instead. See IMAP behavior for folder, flag, and synchronization details.

​

Access modes

accessMode applies to mailbox credentials and controls both IMAP changes and sending:

• read (Read only in the dashboard): Open folders, fetch messages, search, and receive IDLE updates. All folders are read-only, and the credential cannot send mail. SMTP authentication fails with 535, and HTTP sends (POST /emails, replies) with its password return 403.
• read_write (Read & write in the dashboard): Read messages, modify writable folders using operations such as STORE, APPEND, COPY, MOVE, and EXPUNGE, and send through SMTP or HTTP when the sender policy permits the sender. Scopes/* folders remain read-only.

​

SMTP sender policies

The sender policy applies to SMTP and to HTTP sends authorized with the credential’s password. Only read_write mailbox credentials and SMTP-only credentials can send. A disallowed sender is rejected with 553 over SMTP and 403 (This credential cannot send from that address) over HTTP; see Send with SMTP.

​

Exact identity

With sendingMode: "identity", the credential can send only from its configured sendingAddress.

{
  "sendingMode": "identity",
  "sendingName": "Support",
  "sendingAddress": "[e-mail]"
}

The sending address must be covered by an existing domain or address scope. sendingName is optional and can be null; it is credential metadata and does not rewrite the outgoing display name, which comes from the message itself.

The message’s From address and any nonempty SMTP envelope MAIL FROM address must both satisfy the exact-identity policy. An empty envelope sender is permitted, but the message still needs an authorized From address.

​

Any scoped domain

With sendingMode: "scoped_domains", the credential can send from any address on any exact domain represented by its scopes:

{
  "sendingMode": "scoped_domains",
  "sendingName": null,
  "sendingAddress": null
}

For example, a scope for example.com allows [e-mail] and [e-mail], but not [e-mail]. The message’s From address and any nonempty envelope sender must both use an allowed exact domain; an empty envelope sender is permitted.

An address scope restricts incoming IMAP visibility to that address, but it does not restrict SMTP to that address when the sender policy is scoped_domains. A credential scoped only to [e-mail] can still send as [e-mail], [e-mail], or any other address on example.com. Use identity when SMTP must be limited to one exact sender.

​

Login identity is separate

loginAddress is the username for IMAP and SMTP authentication. When a credential is created or its definition is edited, the login address must use an exact domain owned and verified by your account. It does not need to match the incoming scope or the allowed sending identity.

For example, the following configuration is valid when both domains are verified:

Login username: [e-mail]
Incoming scope: [e-mail]
SMTP policy:    identity
SMTP sender:    [e-mail]

The login username does not automatically grant access to mail sent to [e-mail], and it does not automatically authorize that address as an SMTP sender.

Later IMAP and SMTP login attempts recheck both the verified scope domains and the login address’s own verified domain. A domain-status change does not itself disconnect an existing IMAP session; changing or disabling the credential does. See IMAP behavior.

​

Permission examples

Configuration	Read incoming mail	Modify IMAP folders	Send with SMTP
mailbox, read, address scope, identity	Only the scoped address	No	No
mailbox, read_write, domain scope, identity	Addresses on the exact scoped domain	Yes, except Scopes/*	Only the exact configured sender
mailbox, read_write, address scope, scoped_domains	Only the scoped address	Yes, except Scopes/*	Any address on that exact scoped domain
smtp, address scope, identity	No IMAP access	No IMAP access	Only the exact configured sender
smtp, address scope, scoped_domains	No IMAP access	No IMAP access	Any address on that exact scoped domain

Disabled credentials cannot authenticate, regardless of their other permissions.

​

Protocols, IP ranges and limits

Optional per-credential controls narrow these permissions further. protocols can turn off IMAP, SMTP or HTTP use of the password, and allowedIps limits the client addresses it authenticates from. A blocked protocol or address fails like a wrong password. storageQuotaBytes and dailySendLimit cap appended storage and daily sends, and selfService decides whether the mailbox user can manage their own filters, spam settings and password. None of them grants access the credential’s type, access mode or sender policy doesn’t already allow. See Access and Limits.

Manage Credentials

Create credentials, update scopes, disable access, and rotate passwords.

IMAP Behavior

Understand folders, read-only views, flags, limits, and synchronization.