Skip to main content

Email Channel Setup

Growth plan required

The email channel type is available on the Growth plan and above. Creating an email channel on a plan that does not include it returns 403 with "upgrade_required": true and an allowed list of the channel types your plan permits. To upgrade, visit your billing settings.

Email in Hober is a first-class channel alongside push and in-app. Hober delivers email through your own SendGrid account, your own Amazon SES account (see section 7), or Hober-managed sending, authenticated as your sending domain — SPF, DKIM, and DMARC belong to you, not to a shared Hober identity. That means inbox placement depends on DNS records you control, and this guide walks through setting them up and verifying them from the dashboard.

This guide covers creating an email channel, authenticating your sending domain, verifying the DNS records from the per-channel deliverability panel, and the compliance footers Hober adds to outbound email automatically.

1. How email sending works​

Responsibility splits cleanly between you and the platform:

  • You own domain authentication and list quality — who you import and how you got their consent.
  • Hober owns everything after the send button: suppression enforcement, consent checks, bounce and complaint processing, one-click List-Unsubscribe headers, and the feedback loops into your dashboard.

Bounces, spam complaints, and unsubscribes reported back by SendGrid are recorded in a per-tenant suppression ledger and enforced on every subsequent send — see the Deliverability guide for how that ledger works and how to monitor it.

note

SMS and WhatsApp have their own guide: SMS & WhatsApp Setup.

2. Create the email channel​

Dashboard​

  1. Log in to the Hober Dashboard and open Channels from the main navigation.
  2. Start the new-channel wizard and choose Email as the channel type.
  3. Give the channel a display name (unique per workspace, up to 128 characters), and under Email delivery choose Your own SendGrid account.
  4. In the credentials step, paste your SendGrid API key and the verified sender email (the From address you verified in SendGrid). The key is envelope-encrypted on upload and — like every provider credential — write-only: no API or screen returns it, so keep your own record of which key is live. The channel activates on upload.

API​

POST /api/v1/channels
Authorization: Bearer <token>
Content-Type: application/json

{
  "type": "email",
  "name": "Marketing Email",
  "provider": "sendgrid"
}

A successful response returns 201 Created with the channel object:

{
  "id": "6f1d2a34-9c1b-4e8a-b0d2-1a2b3c4d5e6f",
  "type": "email",
  "name": "Marketing Email",
  "provider": "sendgrid",
  "active": true,
  "status": "pending",
  "created_at": "2026-07-27T12:00:00Z"
}

Then upload the credentials:

POST /api/v1/channels/{id}/credentials/sendgrid
Authorization: Bearer <token>
Content-Type: application/json

{
  "api_key": "SG.your-sendgrid-key",
  "sender_email": "hello@yourdomain.com"
}

Both fields are required (422 names the missing one). A 200 returns the credential metadata (never the key itself) and the channel becomes active.

See the Channels API reference for the full channel object, list/update/delete endpoints, and error responses.

3. Authenticate your sending domain​

Email providers decide inbox-vs-spam largely on whether your domain proves it authorized the mail. Domain authentication is configured in your SendGrid account (SendGrid calls it "Domain Authentication"); SendGrid then gives you a small set of DNS records to publish at your DNS host.

What each record does:

RecordTypePurpose
DKIM 1 and DKIM 2CNAMEPoint to SendGrid-hosted DKIM signing keys. DKIM adds a cryptographic signature to every message that receiving servers verify against your domain — proof the mail wasn't altered and really came from you. Two records allow keys to be rotated without downtime.
Mail CNAMECNAMEDelegates a mail subdomain (the return-path) to SendGrid so bounces route back correctly and SPF aligns with your domain.
SPFCNAME/TXTDeclares SendGrid's servers as authorized senders for your domain. Receiving servers check the connecting IP against this record.

DMARC is a policy record you publish yourself (a TXT record at _dmarc.yourdomain.com). It tells receivers what to do with mail that fails SPF/DKIM alignment and where to send aggregate reports. Start with a monitoring policy (p=none) and tighten once your reports look clean. Hober's own transactional domains run the same SPF/DKIM/DMARC setup we ask of you.

4. Verify authentication from the dashboard​

Each email channel has a Sender domain deliverability panel on its channel detail page ("Verify DKIM and SPF records to ensure emails land in the inbox"). It checks your domain authentication status directly against SendGrid and shows the exact DNS records to verify:

  1. Open Channels, then click your email channel to open its detail page.
  2. In the Sender domain deliverability panel, paste your SendGrid API Key (the SG.xxxx... key from your SendGrid account) and click Check deliverability.
  3. The panel lists every authenticated domain on the SendGrid account with each DNS record — DKIM 1, DKIM 2, Mail CNAME, and SPF — showing the record type, host, and value to publish, and a per-record Verified / Pending status.
  4. Add any Pending records at your DNS host, wait for DNS propagation, then click Re-check. Use Change API key if you rotate the key.

The check runs on demand — it is not a background job, so re-check after any DNS change. An invalid key returns 401 with the message Invalid SendGrid API key — check your credentials. The domain counts as verified only when all of its records validate.

tip

Authenticate before anything else. Sending unauthenticated mail is the fastest way to teach providers to distrust the domain — see warming up a new domain.

5. Built-in compliance footers​

Mailbox providers now expect standards-compliant unsubscribe handling from senders. Hober adds this to outbound email automatically — you do not need to template it yourself:

  • One-click unsubscribe headers. Every email carries a List-Unsubscribe header plus List-Unsubscribe-Post: List-Unsubscribe=One-Click (the RFC 8058 mechanism), so Gmail, Yahoo, and other providers can render their native "Unsubscribe" button. One-click unsubscribes are recorded in your suppression ledger the moment they arrive.
  • A preference footer. HTML bodies get a footer with Manage your email preferences and Unsubscribe links; plain-text bodies get the same two links in text form. Preference links open the hosted preference center, where subscribers manage per-category consent without logging in — the links are individually signed and expire.

The footer is appended to email bodies that Hober renders. If you send through a SendGrid dynamic template, Hober does not inject the footer into the template — include your own unsubscribe and preference links in the template design.

Unsubscribes and preference changes feed the same suppression ledger as bounces and complaints, and suppression is enforced at send time. See Deliverability for the full picture, and Message Personalization for personalizing the email content itself.

6. Event webhook — bounces, spam reports, and unsubscribes​

Hober learns about bounces, spam reports, and list-unsubscribe events through SendGrid's Event Webhook. Without it, those signals never reach your suppression ledger — configure it before sending at scale.

  1. Open your email channel in the dashboard (Platform → Channels → your email channel). The Event webhook panel shows your account's URLs — they embed your workspace and channel IDs, so copy them from there rather than constructing them by hand:
    • Event webhook: https://<api-host>/v1/webhooks/email/sendgrid/<workspace-id>/events?channel=<channel-id> (a channel already configured with the older /v1/webhooks/sendgrid/<workspace-id>/events?channel=<channel-id> URL keeps working)
    • One-click unsubscribe: https://<api-host>/v1/email/<workspace-id>/unsubscribe
  2. In SendGrid, go to Settings → Mail Settings → Event Webhook, paste the event webhook URL, and enable at least Bounced, Spam Reports, and Unsubscribes.
  3. Enable Signed Event Webhook. SendGrid then shows a Verification Key — copy it back into the Signed webhook verification key field on the same dashboard panel and save. Hober verifies every delivery's ECDSA signature against this key; until it is set, event deliveries are rejected (the endpoint never accepts unauthenticated events).

Processed events land in the same suppression ledger described above and are enforced at send time.

7. Your own Amazon SES account​

An email channel can send through your own AWS account instead of SendGrid. Hober logs in to the SES SMTP interface of your account. Your SES reputation, sending limits and identities stay yours.

In AWS​

  1. Verify an identity in the SES console, in the region you will send from: the sender address, or better its domain (with Easy DKIM). SES only sends from a verified identity. If your account is still in the SES sandbox, it also only sends to verified addresses: request production access before you send to subscribers.
  2. Create SMTP credentials (SES console → SMTP settings → Create SMTP credentials). These are an SMTP username and password for an IAM user, not your AWS access keys.
  3. Recommended: publish bounces and complaints. Create an SNS topic, then a configuration set with an event destination that publishes Bounce and Complaint events to that topic. Without this, Hober never learns that an address bounced or complained, and keeps sending to it.

In Hober​

  1. Create the channel in the dashboard (Platform → Channels → Add channel → Email → Your own Amazon SES account), or with the API using "provider": "amazon_ses".

  2. Enter the SMTP username and password, the region (for example us-east-1), the sender email, and, if you set them up, the configuration set name and the SNS topic ARN. Hober verifies the SMTP login before activating the channel.

    With the API: POST /api/v1/channels/<channel-id>/credentials/amazon-ses with smtp_username, smtp_password, region, sender_email and, together or not at all, configuration_set and sns_topic_arn.

  3. Open the channel's SNS event subscription panel and copy its URL: https://<api-host>/v1/webhooks/email/amazon_ses/<workspace-id>/events?channel=<channel-id>

  4. In SNS, add a subscription to the topic with protocol HTTPS and that URL as the endpoint. Hober confirms the subscription automatically. It accepts deliveries only from the topic ARN stored on the channel, signed by SNS.

Permanent bounces and complaints then land in the suppression ledger like SendGrid's. Transient bounces (a full mailbox, greylisting) are ignored, because they clear up on their own.

note

SMTP cannot tell Hober whether the sender identity is verified. If it is not, SES refuses each send, and the send fails without a retry. Check the channel's delivery log after the first send.

8. Your own Mailgun account​

An email channel can send through your own Mailgun account. Hober sends with Mailgun's messages API from your sending domain, and Mailgun's reputation, limits and logs stay yours.

In Mailgun​

  1. Add and verify a sending domain (Mailgun → Send → Sending → Domains), for example mg.example.com. Note whether you created it in the US or the EU region: each region has its own API, and a domain lives in one.
  2. Create an API key. A private API key works, and so does a sending key scoped to the domain (Domain settings → Sending keys), which can only send.

In Hober​

  1. Create the channel in the dashboard (Platform → Channels → Add channel → Email → Your own Mailgun account), or with the API using "provider": "mailgun".

  2. Enter the API key, the sending domain, its region, and the sender email. Hober checks that the key works for the domain, and that the domain is active, before activating the channel.

    With the API: POST /api/v1/channels/<channel-id>/credentials/mailgun with api_key, domain, sender_email and, optionally, region (us, the default, or eu) and sender_name.

  3. Open the channel's Event webhook panel and copy its URL: https://<api-host>/v1/webhooks/email/mailgun/<workspace-id>/events?channel=<channel-id>

  4. In Mailgun (Send → Sending → Webhooks), add that URL for the Permanent Failure, Spam Complaints and Unsubscribes events.

  5. Copy the HTTP webhook signing key shown on the same Mailgun page into the panel's Signing key field and save. Hober verifies every delivery's signature against it, and rejects deliveries until it is set.

Permanent failures, complaints and unsubscribes land in the suppression ledger. Temporary failures are ignored, because Mailgun retries them.

9. Your own Postmark account​

An email channel can send through a server in your own Postmark account.

In Postmark​

  1. Confirm a sender signature or verify a domain (Postmark → Sender Signatures). Postmark sends only from one.
  2. Pick the message stream. Every server has a transactional stream, outbound. Postmark allows marketing email only on a broadcast stream, so create one (Message Streams → Create stream → Broadcasts) if the channel will send campaigns. Hober refuses a marketing send to a transactional stream; transactional sends may use either.
  3. Copy the server's API token (the server → API Tokens). It is a server token, not the account token.

In Hober​

  1. Create the channel in the dashboard (Platform → Channels → Add channel → Email → Your own Postmark account), or with the API using "provider": "postmark".

  2. Enter the server token, the message stream (empty means outbound), and the sender email. Hober checks the token and that the stream exists on the server and can send, before activating the channel.

    With the API: POST /api/v1/channels/<channel-id>/credentials/postmark with server_token, sender_email and, optionally, message_stream and sender_name.

  3. Postmark does not sign its webhooks, so Hober generates a secret for the channel. Open the channel's Webhook panel and select Generate URL with secret. The URL it shows carries the secret as basic auth: https://hober:<secret>@<api-host>/v1/webhooks/email/postmark/<workspace-id>/events?channel=<channel-id>

    Copy it now: the secret is not shown again. Generating a new one replaces it, and the old URL stops working. With the API: POST /api/v1/channels/<channel-id>/credentials/webhook-secret returns {"webhook_secret": "…"}.

  4. In Postmark, open the message stream → Webhooks → Add webhook, paste the URL, and select Bounce, Spam Complaint and Subscription Change.

Hard bounces, spam complaints and addresses Postmark starts suppressing land in the suppression ledger. Soft bounces are ignored. A subscription change that reactivates an address does not lift Hober's suppression.

10. Your own Resend account​

An email channel can send through your own Resend account.

In Resend​

  1. Add and verify a domain (Resend → Domains). Resend sends only from a verified domain.
  2. Create an API key (Resend → API Keys). Full access lets Hober check that the sender's domain is verified. A sending access key works too, but then Resend checks the domain only when it sends.

In Hober​

  1. Create the channel in the dashboard (Platform → Channels → Add channel → Email → Your own Resend account), or with the API using "provider": "resend".

  2. Enter the API key and the sender email. Hober checks the key and, with a full-access key, that the sender's domain is verified, before activating the channel.

    With the API: POST /api/v1/channels/<channel-id>/credentials/resend with api_key, sender_email and, optionally, sender_name.

  3. Open the channel's Event webhook panel and copy its URL: https://<api-host>/v1/webhooks/email/resend/<workspace-id>/events?channel=<channel-id>

  4. In Resend (Webhooks → Add Webhook), add that URL for the email.bounced and email.complained events.

  5. Copy the webhook's signing secret (it starts with whsec_) from its page in Resend into the panel's Signing secret field and save. Hober verifies every delivery's signature against it, and rejects deliveries until it is set.

    With the API: POST /api/v1/channels/<channel-id>/credentials/resend-webhook-secret with signing_secret.

Permanent bounces and complaints land in the suppression ledger. Temporary bounces are ignored, because Resend retries them.

11. Your own Brevo account​

An email channel can send through your own Brevo account, with Brevo's transactional email API.

In Brevo​

  1. Add a sender or authenticate a domain (Brevo → Senders, Domains & Dedicated IPs). Brevo sends only from an active sender or an authenticated domain.
  2. Create an API key (Brevo → SMTP & API → API Keys). It starts with xkeysib-. An SMTP key (xsmtpsib-…) does not work with the API.

In Hober​

  1. Create the channel in the dashboard (Platform → Channels → Add channel → Email → Your own Brevo account), or with the API using "provider": "brevo".

  2. Enter the API key and the sender email. Hober checks the key, and that the sender is active or on an authenticated domain, before activating the channel.

    With the API: POST /api/v1/channels/<channel-id>/credentials/brevo with api_key, sender_email and, optionally, sender_name.

  3. Brevo does not sign its webhooks, so Hober generates a secret for the channel, as for Postmark. Open the channel's Webhook panel and select Generate URL with secret. The URL it shows carries the secret as basic auth: https://hober:<secret>@<api-host>/v1/webhooks/email/brevo/<workspace-id>/events?channel=<channel-id>

    Copy it now: the secret is not shown again. With the API: POST /api/v1/channels/<channel-id>/credentials/webhook-secret returns {"webhook_secret": "…"}.

  4. In Brevo, add a transactional webhook with that URL and select Hard bounce, Invalid email, Marked as spam and Unsubscribed. If you create the webhook with Brevo's API (POST /v3/webhooks) instead, use the URL without the credentials and pass the secret as "auth": {"type": "bearer", "token": "<secret>"}.

Hard bounces, invalid addresses, spam reports and unsubscribes land in the suppression ledger. Soft bounces, deferrals and blocks are ignored.

12. Provider templates​

Mailgun, Postmark and Brevo render their own stored templates, like SendGrid's dynamic templates. In a template's email content, choose Provider template and enter the Mailgun template name, the Postmark template ID or alias, or the Brevo template number, with its variables. Postmark and Brevo templates carry their own subject. Resend channels send only Hober-rendered email.