← Learning

Mail intake forwarding

Forward everyday operational email into NiteWtch without AI Studio. Allowed sender domains produce at least a WARNING notification (Slack, webhook, email). Escalation keywords in the subject or body can bump severity to CRITICAL and trigger on-call voice (and SMS when enabled).

Monitoring email routes are unchanged — they still use tenant domain whitelist and AI Studio profiles.

Before you forward

• Create a Mail Intake route in the tenant UI (Mail Intake → create route).
• Add at least one allowed sender domain on that route.
• Configure notification channels that include severity WARNING (base intake alerts are non-voice).
• Include severity CRITICAL if you use keyword escalation.
• Source filter: email or leave filters empty — channels scoped to other sources (e.g. sensor-only) will not receive intake mail.
• Optional: assign an on-call group on the route’s alert source for keyword escalation.

Create a route and copy the address

• Sign in as Tenant Admin and open Mail Intake in the nav.
• Click Create route.
• Add at least one rule with sender domain(s) (e.g. yourcompany.com), schedule (always, during coverage, or outside coverage), and optional escalation keywords (defaults include down, outage, urgent, critical).
• Save the route and copy the inbound address shown in the UI (e.g. alert-abc123-0001@us-west.nitewtch.com).
• Forward mail To this address — do not reuse a monitoring AI Studio route address unless you intend monitoring behavior.

Allowed sender domains

• Domains are managed per Mail Intake route, not via the tenant-wide monitoring domain whitelist.
• Each rule’s sender domain list contributes to the route allowlist.
• Mail from a domain not on the route is hard discarded — no alert is created.
• Use lowercase domains without @ (e.g. notifications.example.com).

Forward from any platform (generic)

Most mail systems support forwarding or transport rules that send a copy to an external address.

• Identify the mailbox or alias that receives the operational mail you want in NiteWtch.
• Create a rule: when message arrives from your allowed domain(s), forward a copy to your Mail Intake address.
• Preserve the original From header when possible — NiteWtch validates the sender domain, not the forwarding mailbox.
• Send a test from an allowed domain with a benign subject — expect a WARNING notification.
• Send a test with an escalation keyword (e.g. subject contains urgent) — expect CRITICAL and on-call path if configured.

Microsoft 365 (coming soon)

Step-by-step transport rule and shared mailbox forwarding for Exchange Online will be added here. Until then, use your tenant’s generic forwarding or transport rule documentation and target the Mail Intake address from the UI.

Google Workspace (coming soon)

Step-by-step routing rule and forwarding for Gmail and Google Workspace will be added here. Until then, use Routing or Forwarding in the Admin console to send a copy to the Mail Intake address.

Notification channel checklist

• Severities: include WARNING and CRITICAL.
• Source filter: email or empty (all sources).
• Voice / SMS: CRITICAL only; SMS requires tenant SMS entitlement.

Mail Intake routes do not use AI Studio profiles. Severity comes from route rules and optional escalation keywords.

Common mistakes

• Confusing Mail Intake with monitoring routes — intake skips AI Studio and uses route-level domain allowlists.
• Forwarding without preserving the original sender — domain validation checks the From address, not the forwarding mailbox.
• Notification channels filtered to sensor-only or missing WARNING severity — intake base alerts will not deliver.