App Engine applications can send email messages on behalf of the app's emailreceiving addresses and on behalf of some users with Google Accounts. Apps canreceive email at various addresses. Apps send messages using the Mail serviceand receive messages in the form of HTTP requests initiated byApp Engine and posted to the app.

Sending mail

The Mail service can send email messages to one or more recipients. A messagecontains a subject, a plaintext body, and an optional HTML body. It can alsocontain file attachments and a limited set of headers.

You can use any email address for a recipient. A recipient can be in themessage's "to" field, in the "cc" field, or hidden from the message recipients(a "blind carbon copy" or "bcc").

When an application calls the Mail service to send a message, the message isqueued, and the call returns immediately. The Mail service uses standardprocedures for contacting each recipient's mail server, delivering the message,and retrying if the mail server cannot be contacted.

Who can send mail

For security purposes, the sender address of a message must be one of thefollowing:

• The Gmail or Google Workspace Account of the user who is currently signed in
• Any email address of the formanything@[MY_PROJECT_ID].appspotmail.com oranything@[MY_PROJECT_NUMBER].appspotmail.com
• Any email address listed in the Google Cloud console underEmail API Authorized Senders

All email addresses on theEmail API Authorized Senders list need tobe valid Gmail or Google-hosted domain accounts. App Administrators can add thefollowing accounts to the list of Authorized Senders:

• Their own email address
• Any group for which they are an Owner or Manager
• Applications hosted in a Google Workspace domain:noreply@[DOMAIN].com, aslong asnoreply@[DOMAIN].com is a valid account (user or group).

In addition, domain administrators of domains managed by Google Workspace canadd any user in their domain to the list of authorized senders.

You are limited to a maximum of 50 authorized senders.

Mail from Google Workspace

If you will be sending email from a domain managed by Google Workspace, youshould set the DNSSPF records for your domain to indicate that Google is atrusted source for your email. For instructions on how to do this, seeSPFrecords in the Google Workspace Help Center.

Note that if you use aliases set up for your Google Workspace domain, you cannotsend email from email addresses that use the domain alias.

Bounce notifications when mail is not delivered

Mail that matches a known signature for spam, viruses, or other maliciouscontent may not be accepted for delivery.

If the Mail service cannot deliver a message, or if a recipient's mail serverreturns a bounce message (for example, because there is no account for thataddress on that system), an error message can be sent by email to the address ofthe sender for the message. The application itself does not receive anynotification about whether delivery succeeded or failed.

By default, email bounce notifications are not enabled. In order to receiveemail bounce notifications, you need to configure your application.For moredetails, seeReceiving BounceNotification.

Mail and the development server

The development server can be configured to send email messages directly fromyour computer when you test a feature of your app that sends messages. You canconfigure the development server to use an SMTP server of your choice.Alternatively, you can tell the development server to use Sendmail, if Sendmailis installed on your computer and set up for sending email.

If you do not configure an SMTP server or enable Sendmail, when your app callsthe Mail service, the development server will log the contents of the message.The message will not actually be sent.

Authentication with DomainKeys Identified Mail (DKIM)

When you send mail, App Engine uses the DomainKeys Identified Mail(DKIM) standard to authenticate the domain. If your application sends messagesfrom an email address that is part of a Google Workspace domain,App Engine cancryptographically sign the emails it sends. This signature says that an emailthat purports to be fromemma@example.com really came fromexample.com. Therecipient can check this signature; if the signature is correct, the recipientknows that the sender's domain wasn't spoofed.

To enable DKIM authentication for messages sent from Google Workspace emailaddresses, followthese instructionsin the Google Workspace Help Center. Note that it can take up to 48 hours beforeDKIM authentication is active for your Google Workspace domain.

You must also ensure that your application isusing a customdomainand is the same as your Google Workspace domain. Also note that Google Workspacedomains with subdomains such assubdomain.example.com are not permitted.

App Engine will sign the application's outgoing mails if the senderaddress is part of a Google Workspace domain with DKIM enabled. Additionally,the sender address must be formatted such that the domain part of the emailaddress only consists of lowercase letters.

Quotas and limits

To see the current quota usage of your application, go to the Quota Details pagein the Google Cloud console.

Go to the Quota Details page

Each Mail service request counts toward theMail API Calls quota. There arealso quotas for the number of messages you can send, the number of Adminmessages you can send, and the amount of data and attachments you can send. Formore details, seeMail quotas.

The quota is reset daily. If you exceed the daily quota, you will get anoverquota exception. If youneed to send more mail than the quota allows, you can use a third-party mailprovider, such asSendGridorMailgun.

In addition to quotas, the following limits apply to the Mail service:

What's next

• Read the bulk mail guidelines.
• Learn how to use the Mail API to send mail and receive mail.