Send email from your domain

Udibo emails your users to verify addresses, reset passwords, and sign them in. Connect your own Resend account so those messages come from your domain, verify that domain, and learn what changes for your users when you do.

Emails your users receive

When a person asks for a password reset or creates an account from a sign-in your application started, or their account locks during one, the link in the reset, verification or unlock email brings them back to your application once they are done. The link carries only a single-use token: where it returns them is stored with the token, so it can only be your application's address (the origin of one of its registered redirect URIs, where your application starts a fresh sign-in) or a page on your tenant's host.

A verification link verifies the address only for a person signed in to the account it was sent for. Someone who opens it signed out, for example on another device, is asked to sign in and comes back to the same link to finish; someone signed in to a different account is asked to switch. Until then the address stays unverified and the link stays usable. This stops anyone who creates an account at someone else's address from getting that address verified by tricking its owner into clicking the link. A person who verifies goes straight back to your application when the account was created from a sign-in it started; otherwise they see a confirmation with a link back to it, or to their profile page when your tenant has no application to return to.

Security notices go only to a verified address. New-device notices are off by default and are not a setting you can change for your tenant. Dashboard invitations and usage alerts are about your tenant, not your users; they always come from Udibo and are not affected by your sender.

What your branding changes in email

Every email in the table names your product using the display name from your branding, or your tenant name when you have not set one. Every email in the table that has a button fills it with your light mode accent color, even when your pages offer only dark mode; a light mode accent is used only if it passes the light mode rule, so one saved while light mode was not offered, or one that no longer passes, falls back to Udibo's accent.

Each of these emails opens with your light mode logo beside your display name, or the logo alone when Logo includes your name is ticked; a dark mode logo is not used. Many email clients, Gmail among them, do not show SVG images, so use a PNG or WebP logo for it to appear. The server hosting your logo receives a request each time a recipient opens one of these emails with images turned on. Each email ends with a footer that says why the person received it and that your display name sent it, with a link to your support URL when you have set one. Your page background is not used, and email content cannot be customized.

To see the result, open Settings → Branding in the dashboard: the Email preview at the bottom of the tab shows the verification email with your saved branding.

Delivery by Udibo

Until you connect a sender, Udibo delivers these emails from a shared sending address. Each tenant has a daily ceiling on it; mail past the ceiling is not sent, and the person is not told. These emails count toward "Emails sent by Udibo" on pricing. If you set an email limit on your Billing page, sending stops when it is reached, sign-in and recovery email included.

Manage usage, limits, and alerts explains the separate daily and monthly controls, alert recipients, and what to check when sending stops.

Connect your own sender

Only Resend is supported. Before you start, add your sending domain to your Resend account and create an API key there. Udibo reads the domain's status and DNS records from Resend; it does not create the domain for you.

Saving, verifying the domain, or removing the sender requires Manage tenant settings. The built-in Owner and Admin roles carry this permission; Support does not.

1. Open your tenant in the dashboard, choose Settings, then the Email tab.

2. Enter your Resend API key. It is required the first time, stored encrypted, and never shown again; leave it blank later to keep it.

3. Enter the From address, such as no-reply@yourdomain.com.

4. Optionally fill in the rest:

   • From name, up to 100 characters, with at least one visible character and no line breaks, invisible characters or text-direction marks. Most emoji work, including country flags, skin tones and keycaps. Emoji built from several joined together, such as 👩‍💻, 🏳️‍🌈 or 🏴󠁧󠁢󠁥󠁮󠁧󠁿, do not. Your branding display name is not used as the From name.

   • Sending domain, which defaults to the from address's domain. Changing it discards the last domain check.

   • Webhook signing secret; see record bounces and complaints.

5. Choose Save email sender.

The section then shows Configured, the provider, a domain status, and the exact sender, for example Acme <no-reply@yourdomain.com>. Your emails go through your Resend account from then on, whether or not the domain is verified yet. Udibo bills nothing for them; your provider's charges apply. You can set a separate limit and alert for them on your Billing page.

Configured means the settings are saved. Saving does not test that the key can send mail or that a message reaches an inbox. Complete the domain check, send a test email, and run the delivery test before depending on this sender for sign-in or recovery.

Verify your sending domain

After you save, the page asks Resend for your domain's status and lists the DNS records to publish, each with its own status. Add them at your DNS provider, then choose Verify domain to check again. The page shows when the domain was last checked. A check sends no email and changes no DNS records.

The domain badge shows Resend's answer: Verified, Pending verification, Not started, or Verification failed. Could not verify — check in Resend means Resend did not answer or the key cannot find the domain in that account.

Until the domain is verified, mail from it is likely to be rejected or land in spam. Also publish a DMARC record for the domain.

Record bounces and complaints

In Resend, add a webhook that sends bounce and complaint events to https://www.udibo.com/api/webhooks/resend/{tenantId}, then paste its signing secret into Webhook signing secret. The Email tab shows that address as Webhook URL, with a copy button. Deliveries with an invalid signature are refused.

A permanent bounce or a spam complaint adds the address to your tenant's suppression list. Udibo then skips security notices, waitlist emails, and organization invitations to it. Emails a person asks for — verification, password reset, sign-in codes and links, and account unlock — are still sent.

Watch sender health

• "Your Resend API key cannot be read." Replace the API key. Until you do, your emails go out through Udibo's shared sender under its limits.

• "Resend has rejected recent email sends from your domain." At least two sends were refused for invalid credentials in the last 24 hours. Check or replace the key in Resend.

• A failed send is recorded in your audit log as email.delivery_failed.

A message rejected by Resend is not retried through Udibo's shared sender. Repair the key or domain and repeat your delivery test. To return to shared delivery, deliberately remove your sender; its allowances and limits then apply.

Remove your sender

On Settings → Email, under Danger zone at the foot of the tab, choose Remove email sender and type the sender address to confirm. Every email goes out through Udibo's shared sender again, and your API key and webhook secret are deleted rather than kept.

Manage the sender through the API

The management API exposes the same settings at /api/identity/{tenantId}/email-sender, with a verify operation for the domain check. It never returns your API key or webhook secret. Today you reach it through the dashboard; see choose the right API.

Send a test email

On Settings → Email, choose Send test email under Test email. Udibo sends one email, with your branding, through the sender your users get their email from: your own sender when one is connected, otherwise Udibo's shared sender. It goes only to the verified email address on your own Udibo account, which the section shows; you cannot send it to anyone else. If that address is not verified yet, the section says so and links to your profile to verify it.

The page then says either that the email was sent, and to whom, or why it was not: for example, that Resend rejected your API key, that an email limit was reached, or that Udibo's shared sender is holding your mail.

• Sending requires Manage tenant settings.

• You can send 5 test emails an hour, and your tenant can send 20 a day between all its administrators.

• Each test email counts toward your email limits like any other email, and is recorded in your audit log as admin.email.test_sent, without the address.

A test email that arrives shows the sender works. It does not test sign-in or recovery; for that, follow the steps below.

Test before launch

1. Use a known test account in your tenant with an inbox you control. Confirm that its address is correct and that the affected sender has room under its email limits.

2. For an account with a password, open https://{tenantId}.udibo.com/forgot-password and request a reset for that address. If you offer an email sign-in method, request its code or link from the tenant's sign-in page instead.

3. Confirm the message arrives, including in the spam folder. Check the From address and the message headers to confirm your sending domain and that SPF and DKIM pass.

4. Complete the test flow: follow the reset link and sign in with the new test password, or redeem the code or link. Receiving a message alone does not prove the sign-in or recovery flow completes.

5. Repeat with the other emails your tenant uses and inboxes at more than one mail provider.

The password-reset page deliberately gives the same success message when an account is unknown, a send is refused, or delivery fails. That notice is not proof that a message was sent. Configured and Verified also do not establish delivery: the domain check reads Resend's domain status and sends no email. Send a test email for that.

If a message never arrives, check Resend's logs and your audit log, then follow email troubleshooting.

Limits today

• Resend only. No other email provider can be connected.

• Fixed content. Subjects, text, and layout cannot be customized beyond your display name, light mode logo and accent color, and support URL.

• No sending from your domain through Udibo. Mail comes from your domain only through your own provider.

Next: brand your hosted pages, or set up passwordless sign-in.

Last verified 2026-11-04.