Connecting an inbox
All three providers are set up from the same Add sending identity panel on the Inboxes page — pick a provider tab, then follow that provider's flow.
On this page
Business email only
Every connection path — Google OAuth, Microsoft OAuth, and manual SMTP — runs the same personal-domain check before the inbox is saved. Gmail, Googlemail, Outlook.com, Hotmail (and its regional variants), Live, MSN, Yahoo (and its regional variants/aliases), iCloud, Mac.com, AOL, ProtonMail, GMX, and Mail.com are all blocked, along with a few others on the same list.
Trying to connect a blocked domain fails with: "Please use a business email address — ForgeSend is built for sending from a domain you control, which protects your deliverability and keeps your outreach looking credible. Connect a Google Workspace, Microsoft 365, or custom domain inbox instead."
Zoho Mail is deliberately not on the blocked list — it's offered as a supported SMTP preset below, not treated as a personal-email domain. The block list targets consumer webmail, not every third-party host.
Google Workspace
Clicking Continue to Google submits a real form post to the backend, which redirects your browser into Google's OAuth consent screen — it isn't a background API call.
Beta notice
Before you connect Google
Google may show an "app isn't verified" warning while ForgeSend's Google verification is under review. This is expected. Continue only with a mailbox you control.
ForgeSend requests five Google scopes: openid, email, profile, gmail.send, and gmail.readonly. The read scope is what lets ForgeSend check for replies in this mailbox; sending uses the send scope. Tokens are encrypted at rest before they're stored.
The "app isn't verified" warning is expected while ForgeSend's own Google OAuth app is going through verification review — it's not a sign anything is misconfigured on your end.
Microsoft 365 / Outlook
Same pattern as Google — Connect with Microsoft is a form post that redirects into Microsoft's identity platform.
Connect Microsoft 365
Connect Outlook through Microsoft identity and Graph permissions. Recommended for M365 users.
Connect with MicrosoftThe Microsoft scopes requested are openid, email, profile, offline_access, User.Read, Mail.Send, and Mail.Read — Microsoft-connected inboxes get the same reply-checking capability as Google ones do.
SMTP / Manual
For any other provider, the SMTP tab is a two-step form.
Step 1 — Choose your email provider
Step 2 — Enter your credentials
From email
Display name
SMTP username
App password
Fetch replies via IMAP
Exactly four presets exist today: Outlook / M365 (smtp.office365.com · 587 · STARTTLS), Zoho Mail (smtp.zoho.com · 465 · SSL/TLS), cPanel / Fasthost (blank host, manual entry), and Other / Custom (blank host, manual entry). Gmail and Yahoo presets do not exist — the code comment on this exact array explains why: "Gmail and Yahoo are deliberately absent — both are personal free-email domains that connectSmtpInbox()/testSmtpConnection() now reject outright, so a one-click preset for either would just walk the user into a guaranteed rejection." Whichever preset you pick, the visible fields are always From email, display name, SMTP username, and app password; only cPanel/Fasthost and Other/Custom expose a raw host/port/security picker for manual entry.
- Test calls the SMTP verification endpoint directly without saving anything — use it to catch bad credentials before committing.
- Save Inbox re-runs that same verification, then saves. It will not save an inbox that fails verification.
- Checking Fetch replies via IMAP reveals IMAP host, port, security, username, and password fields, stored separately from the SMTP credentials — a mailbox can send via SMTP without configuring reply-fetching at all.
Use port 465 (SSL/TLS) where your provider offers it. Port 587 (STARTTLS) can be blocked outbound on some VPS providers — if 465 isn't available, select STARTTLS explicitly rather than assuming the default will work.
Reconnecting and disconnecting
Disconnecting an inbox is a soft disable, not a delete:
- Status changes to Disconnected, with
lastErrorset to"Disconnected by user"and the OAuth token expiry cleared — the encrypted access/refresh tokens themselves are left in place, not wiped - Any of that inbox's still-queued (
PENDING) sends are marked Skipped, with the reason"Skipped: inbox disconnected"— not deleted, not silently sent later - Reply history, past send jobs, the daily-limit record, and (for SMTP) the stored SMTP/IMAP config are all preserved
Disconnect inbox?
Your message history will be preserved. This inbox will stop sending and checking for replies until you reconnect it.
How you get back to Connected depends on the provider:
- Google / Microsoft — a Reconnect button (amber for a manual disconnect, red for an error state) re-runs the OAuth flow. Because inboxes are keyed on workspace + provider + email, this updates the same row rather than creating a second one.
- SMTP — there's no one-click reconnect button; the row just shows "Reconnect from the SMTP / Manual panel" and points you back there to re-enter and re-verify credentials.
Reconnecting an OAuth inbox checks that the Google or Microsoft account you authenticate with actually matches the email address already on file for that inbox. If you try to reconnect with a different account, ForgeSend rejects it rather than silently swapping the inbox to a new mailbox.