Security and daily use - Custom SMTP
Scopes: platform and account
Mail configuration lives in two scopes - platform (no account attached) and account. Only the Dock team configures the platform; it serves the application's system mail and the operational mail of internal accounts. A subscriber configures only their own account and never falls back to the platform configuration - that is a deliberate boundary, not an oversight.
The resolution chain
For a subscriber the path is short: account/purpose → account/default → no operational send. The platform configuration never steps in as a fallback for a subscriber - otherwise a client's monitoring failure would quietly load Dock's own mail server. For an internal account (Dock's own projects) the chain is longer: account/purpose → account/default → platform/purpose → platform/default, because an internal account and the platform are, in practice, the same team.
Who has access
Managing an account's mail is held by the owner and admin roles - not developer, not accountant. That split is deliberate: SMTP configuration decides where an account's mail comes from, not project work or billing. Platform settings are edited only by the Dock team, with the matching platform permission.
How the password is stored
The SMTP password is encrypted in the database and never comes back to the form - leaving the field blank on save means 'keep what is stored'. The separate configuration switch works the same way: turning it off does not delete the saved password, it just tells DockRay to fall back on the default configuration of this scope for now. Turning it back on restores the old data without re-entering it.
Why a change does not take effect in the queue right away
The configuration is cached so it is not queried on every outgoing message. The process handling panel requests picks up a new value on its first query after saving, but the queue worker only picks up the change after it restarts - alerts and reports go out through the queue, so changing a password or a host may need a manual worker restart to take effect immediately, rather than waiting for the cache to expire on its own.
Deliverability: SPF and DKIM
A correct login and password alone do not guarantee a message lands in the inbox instead of spam. It is worth making sure the sender address's domain has correctly configured SPF and DKIM records - that sits with the mail provider and the domain's DNS, not with DockRay itself.