Sending Portal Email from Your Own Domain

Out of the box, the portal’s email (sign-in codes, invitations, notifications) is sent by Pental, from Pental’s address. It works, but the address is not yours, and a client receiving an invitation from a name they do not recognise is a support call waiting to happen. Connect your own mailbox, or give it a mail server, and the email comes from you. The setup is in two places, and knowing which is which saves a lot of hunting.

The connection: your pental.io dashboard

1. Sign in at pental.io. Under Portal Configuration, open Email (SMTP). Until you set it up, it says the portal is sending via Pental email.
2. Under Which address should emails come from?, type the address clients should see and press Continue. It can be anything on a domain you control, no-reply@yourfirm.com for example.
3. Connect the mailbox, which the screen marks as recommended: Connect Microsoft 365, Connect Google Workspace or Connect Zoho Mail, for whichever the address belongs to. You sign in once in a window the provider opens, and the address is filled in for you.
4. Or choose Or set up an SMTP server by hand, pick your email provider, and give the SMTP host, the port, the username, an app password (not the one you sign in with) and the sender name.
5. Under Send the test to, give an address and press Send test email, then Save SMTP. A mail server needs a passing test before it saves; a connected mailbox saves without one, because changing its address is how you get past a failing test.

• Publish SPF and DKIM for the sending domain, or your invitations will land in spam and the portal will get the blame.
• Send the test to an address on a different provider from your own. Your own server is always kind to you.
• A Microsoft 365 test that is accepted and never arrives, with a bounce saying 550 5.7.708, is Microsoft holding back a new or trial tenant’s mail to outside addresses, not the connection: the fix is a support request to Microsoft. The screen offers to send the test to the mailbox’s own address instead, which stays inside Microsoft and shows whether the connection itself works.

Who sends it, and what passes through Pental

Saving puts the connection in your own database, its secrets encrypted there. What happens next depends on whether your database can send email itself:

Locked to your side once it sends

From the first email your own side sends, your database locks the portal’s email to it, for good. Pental’s servers are given neither the mailbox’s password nor its token and send none of your email. An email that cannot go just now waits in your database and is tried again, a sign-in email for ten minutes and the rest for longer. What Pental’s servers still write, such as a security notice, an address change or the dashboard’s own test, is handed to your database to send. The dashboard says so, and no longer offers Revert to Pental email.

What a connected mailbox decides for itself

Mail sent through a connected mailbox carries that mailbox’s own display name, and replies follow its own rules, so the screen offers no box for either. Change the name in the Microsoft 365 admin centre under Users, or in Gmail settings under Accounts and Import, and set a reply or forwarding address on the mailbox itself. To send from an alias, type it under Emails are sent from: aliases are not listed, because Pental does not ask for permission to read your directory, and the mailbox needs Send As rights on the address. On the SMTP route the sender name is a field of its own, and replies go to the Reply-to email under Settings, Notifications in the portal (blank: your company email).

Sending from no-reply, and whether you should

Most firms start on a monitored address and move to a no-reply one when the volume of automated mail makes a monitored inbox a chore. Both are legitimate; the reason to move is volume, not etiquette. A no-reply address is filtered slightly harder by some gateways, and a few people reply to it regardless, so the move only pays once somebody is genuinely spending time on replies that need no reply.

• Microsoft 365: create no-reply@yourfirm.com as a shared mailbox in the Microsoft 365 admin centre (shared mailboxes need no licence), then connect the licensed mailbox that has Send As rights on it and type the no-reply address as the one emails come from.
• Google Workspace: create the address as an alias of the user who sends (or as a group), add it in Gmail under Settings, Accounts, Send mail as, and confirm it. The connected account can then send from it.
• Either way, make sure replies reach somebody. A no-reply sender whose replies go nowhere is a dead end for anyone who does reply, which is the part people notice.

A no-reply mailbox nobody reads is worse than a monitored one: mail arrives and sits there unseen. Give it a mail-flow rule that rejects incoming mail with a line saying where to write instead, so the sender is told immediately rather than left waiting. In Exchange it is Mail flow, Rules, "Reject the message with the explanation"; in Google it is a routing rule on the address.

The wording: your portal

Inside the portal, Settings then Email Templates lists every email the portal sends, grouped by who receives it, in your colour. Edit the subject and the wording of any of them, with variables such as {{assessment_name}} for the parts that change; Preview shows exactly what is sent and Test sends one. No email carries a logo unless its template includes {{logo}}. The SMTP & Signature tab holds the signature that can go beneath them (off until you switch on Append signature to notification emails) and says how this portal sends email right now.

The sign-in code email carries a code to type, not a link. Mail security services such as Safe Links, Proofpoint and Mimecast open every link in a message to check it, which spends a single-use link before the recipient ever sees it. A code has to be typed, so only the person can use it. Do not add a sign-in button to that template.

Check it end to end

• Invite yourself as a client user and read the whole journey exactly as they receive it.
• Confirm the links in that mail point at your own domain, not the default one.
• Set the notification preferences so your team hears about what matters and nothing else.

Email from your own address is one part of white-labelling the portal; Security sets out what Pental’s servers hold and what they cannot reach.