What types of domain authentication are available to me? 

Genesys Cloud supports the following domain authentication mechanisms:

• SPF (Sender Policy Framework) – SPF helps detect spoofing by identifying which mail servers are authorized to send email on behalf of your MAIL FROM domain. Receiving mail systems query the domain’s SPF TXT record to verify that the sending server is permitted to transmit messages for that domain. SPF alone validates only the domain in the MAIL FROM address, which is not visible to recipients.
• DKIM (DomainKeys Identified Mail) – DKIM adds a digital signature to outbound email messages within the message header. The receiving mail server validates this signature using the public key published in DNS to confirm that the message was authorized by the domain and has not been altered in transit. DKIM alone validates only the domain in the DKIM signature, which is also not visible to recipients.
  Unlike SPF, DKIM remains valid when a message is forwarded, because the signature is embedded in the email header. SPF authentication can fail during forwarding since the forwarding server modifies the message envelope, but DKIM continues to function as long as the message content is unchanged.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance) – DMARC builds on SPF and DKIM by enforcing domain alignment. The enforcement happens within your email infrastructure and by receiving mailbox providers, which apply the policy (none, quarantine, or reject) based on the DMARC record published in DNS. It requires that the domain visible in the From address (the address displayed to recipients) aligns with the domain validated by SPF and/or DKIM. DMARC ensures that at least one of these authentication methods aligns with the visible From domain, providing stronger protection against domain spoofing and impersonation.

Does DMARC monitoring block or reject email?

No. Genesys Cloud does not quarantine, reject, or block outbound messages based on DMARC. Monitoring provides visibility only. Enforcement occurs at the receiving email provider when a DMARC policy of quarantine or reject is published.

What happens if no DMARC record exists?

Genesys Cloud displays a Not Present status. Email can still be delivered, but mailbox providers can treat unauthenticated messages as suspicious, which can negatively impact deliverability.

What does “Invalid” DMARC status mean?

The DNS record must follow proper DMARC formatting standards to be recognized as valid. An Invalid status indicates:

• Incorrect record syntax
• Missing required tags
• Formatting errors in the DNS TXT record

Does this process apply to custom SMTP or Microsoft Graph?

Genesys Cloud displays DMARC status for awareness when these channels are used. However, authentication behavior and enforcement outcomes occur within the said email infrastructure, which lies outside the involvement of Genesys Cloud.

Does DMARC monitoring affect inbound email?

No. DMARC monitoring applies only to outbound email domains and does not impact inbound email flows. Genesys Cloud does not act as an SMTP gateway or enforcement point for inbound email authentication.

Does Genesys Cloud create or manage DNS records?

Genesys Cloud reads and reports status. It also provides the TXT record value of the DMARC in the correct format that you can use in the DNS records. You are responsible for creating and maintaining SPF, DKIM, and DMARC records with your DNS provider. 

Why should I use both DKIM and SPF with DMARC?

By default, CGR first checks whether the current queue is under stress. Therefore the first CGR rule is always the current queue and cannot be changed.

The SL % is calculated based on the interactions that are answered during the span of 30 minutes preceding the time the routing system calls the analytics API to run a CGR rule. If there are no interactions in the 30 minutes, the SL % cannot be calculated. As a result, the CGR rule evaluation will fail and routing will move to the next CGR rule evaluation, if available.

Ensure you add that groups that are required for CGR are as members to the queue. After you create the needed groups or work teams, add them as members to the queue.

The Graph integration I setup in Genesys Cloud is active and when I test the integration using the Test option, the integration is successful. Despite that, I am unable to send and receive emails through the integration.

If you still face issues, check for the following:

• Check that a valid license is assigned to the mailbox you are connecting to. Each mailbox should have a license associated with it.

• Ensure that you have no application policy that is preventing access to the mailbox. For more information, see Role Based Access Control for Applications in Exchange Online.

• Ensure that the registration is active on the Azure side. To restart the registration, disable and enable the Graph integration again.

• Every time you update your Azure configuration, disable/enable the Graph integration so that the registration is refreshed with the new settings.

What are the minimal Azure permissions required for the Genesys Cloud Graph integration to work?

At the minimum, you will need the following three permissions for the Graph integration to work:

• Mail.ReadWrite – type Application
• Mail.Send – type Application
• User.Read – type Delegated

Verify that you see a green check mark indicating Admin consent is applied.

How do I limit application permissions to specific mailboxes?

To limit app permissions to specific mailboxes, see Mircosoft documentation. 

Where do I obtain the OAuth 2.0 token endpoint (v2) value from?

The OAuth 2.0 token endpoint comes from your Azure configuration. Add the endpoint when you configure and activate the Microsoft Graph integration.

Is the User.Read permission required?

This permission is required for the integration to work. The Type is Delegated and is not Application. Therefore, verify that there is a green check mark indicating admin consent is applied as well.

Is there a range of IP addresses that we need to add to the Azure from our end?

That is not required. Azure will connect with our public endpoints for all notifications.

Is there any configuration to mark the emails as read in the Azure inbox as soon as they are transferred to Genesys Cloud?

Ensure that the Mail.ReadWrite permission is set up in the Azure application. The Microsoft Graph integration marks the email as read once they are transferred to Genesys Cloud. 

Can we create a Campaign/Agentless domain with the same name as the inbound domain being used by Microsoft Graph integration?

Yes. Although reuse of domain names is not supported in Genesys Cloud as of now, this particular use case is supported.

How often are emails retrieved from the mailboxes?

Genesys Cloud receives Microsoft async notifications on changes occurring on the Microsoft Exchange server. This includes receipt of new emails. Microsoft Graph integration pulls emails when it receives the notifications on new emails.

Emails are being marked as read in my mailbox, but we have not received the email in Genesys Cloud. What could be wrong?

If emails are marked as read, it means that the system was able to download them. Check the following:

1. Check the flow that is associated with the inbound route.

2. Open the associated inbound flow and check how emails are being handled.

3. Verify that you have have agents logged in the queue used by the workflow.

When an incoming email has multiple recipients from our domain, the email is routed only to one recipient and only one interaction is created in Genesys Cloud. Why?

By default, if an incoming email contains more than one email address that maps to more than one Genesys Cloud route, Genesys Cloud routes to only one of the email addresses. To route the email to all the destinations in the email, enable the Route to Multiple Destinations setting.

Why do we need to give the User.Read permission for the API in Azure?

The permission provides access to the user’s email address. If this permission is not granted, the Microsoft Graph integration is unable to read the related emails. The integration will not be able to process, encrypt, and scan emails. For more information, see Custom Microsoft Graph integration for inbound and outbound emails and Create subscription – Microsoft Graph v1.0.  Also note that the permission type is Delegated, and is not Application. For more information, see Microsoft Graph permissions reference – Microsoft Graph.

Is it mandatory to add Genesys Cloud IP addresses to connection filter policy? What is the impact if this step is not performed?

This is optional, but is strongly recommended. It avoids untrusted sources from reaching Microsoft email servers. If an IP is blocked, emails will bounce.

Will there be an authentication issue if the client secret that is set up in Azure and is used with the Graph integration expires?

Yes, when the client secret you used with the Graph integration has changed or expired, you will face authentication issues unless you make the change in the Genesys Cloud Graph integration too. Note that you cannot have a client secret in Azure without an expiry date. When you change the client secrets on the Azure side or the secrets expire, you must ensure you make the change in the Graph integration in Genesys Cloud as well. Otherwise, the integration will not work when the token from MS is refreshed. Because each time a request is sent, it includes the token’s validity. A best practice is to do changes at both ends with no delay. And if you make any changes with no delay, before the token is refreshed, emails will be pulled as expected.

You can configure a maximum of 100 SMTP connections in a pool. If there are not enough connections, Genesys Cloud queues the email and retries to deliver the message. If there is a delivery failure, Genesys will open a case to investigate the issue and intimate you via Support. 

For Amazon SES, query the SES’s SPF record for a list of IP addresses from which your email can be sent. For more information, see Amazon SES IP addresses.

For custom SMTP integration, to retrieve a list of IP addresses from which your email can be sent, go to the Genesys Developer Center and use the GET /api/v2/ipranges API.

By default, Genesys Cloud only routes to one email address even when multiple email addresses are included in the email. The email address that is chosen for routing is not predictable. To route to all email addresses specified in the email, enable the Route email to multiple destinations.

Genesys Cloud does not include parked/unparked emails and reconnected emails to calculate utilization. 

For recommendations and best practices from Genesys, see Malware and antispam protection best practices. 

For further information on SES and AWS’s approach to security, see the following:

• General information on SES, how it works, and use case examples: https://aws.amazon.com/ses/
• SES security breakdown: https://docs.aws.amazon.com/ses/latest/dg/security.html
• Overview of SES sending authorization: https://docs.aws.amazon.com/ses/latest/dg/sending-authorization-overview.html
• How email sending works in SES: https://docs.aws.amazon.com/ses/latest/dg/send-email-concepts-process.html
• AWS Shared Responsibility Model: https://aws.amazon.com/compliance/shared-responsibility-model/

For outgoing emails, Genesys Cloud uses opportunistic TLS that Amazon Web Services (AWS) provides; you cannot set forced TLS. For inbound emails, Genesys Cloud uses TLS to receive emails. This means that Amazon SES always attempts to make a secure connection to the Genesys mail server, and Genesys Cloud accepts a message as secure if it is sent as secure. If Amazon SES cannot establish a secure connection, it sends the message unencrypted.

Conversations are encrypted in transit and internally within the platform while at rest. When the conversation leaves Genesys Cloud, there is no guarantee for encryption. For email delivery that requires encryption or other security protocols, we recommend you use your own server for sending emails. For more information, see Configure and activate the custom SMTP server integration.

Yes. For more information about how to reply to a closed email, see the Reconnect to a closed email section of any of the following articles:

• Agents Interactions Detail view
• Campaign Interactions Detail view
• Content Search view
• Interactions view
• My Interactions view
• Queues Interactions Detail view

Administrators can enable multiple actions on a single email that allows agent to perform different actions on a single email such as replies and forwards before they disconnect and wrap-up the interaction. For more information, see Use the organization’s email domain name.

For more information on how the option appears on the agent desktop, see Reply to or forward an email message interaction.

Retraining fails due to insufficient data for certain media types, because of a reduced number of interactions on the queue since activation. For more information, see Predictive routing during KPI processing phase.

In some cases, the AWS region used for ACD email differs from the corresponding AWS region. Regardless, email processing and data storage occurs in the AWS region. The email simply passes through the AWS region for ACD email. For example, your organization’s AWS region is ap-northeast-1 and the corresponding AWS region used for ACD email is us-east-1. When a user in your organization sends an email, it passes through us-east-1, but the email processing and data storage takes place in ap-northeast-1.

Genesys Cloud processes inbound email through AWS Simple Email Service (SES), which scans messages for malware (viruses and spam). If SES detects a virus in an email, or if the virus scan is incomplete or inconclusive, Genesys Cloud immediately disconnects the email and does not send it to a queue. However, no antivirus solution is 100% effective so Genesys recommends that you install antimalware software on every Genesys Cloud endpoint. For more information, see Malware and antispam protection best practices. 

This FAQ is closely related to How does Genesys Cloud handle email marked as spam? When SES (or another tool) identifies email as spam, that email has a higher likelihood of including malware links in attachments or phishing schemes with links in the content. 

To provide agents with as much context as possible for customer replies, Genesys Cloud threads emails together. Genesys Cloud threads email messages based on the “In reply to” header and the “References” header. This process ensures that messages that originate from certain email clients and contain the same subject and sender information but are unrelated, are no longer associated with each other. 

When a customer replies to an existing email from their email client, Genesys Cloud threads the email with the previous message and the agent receives the full email thread history. However, when a customer sends a new message from their email client, Genesys Cloud initiates a new conversation but does not thread the email. By default, Genesys Cloud threads email messages together if it receives a reply within 30 days. 

In addition to the header-based threading, you can also thread emails based on subject line. Genesys Cloud checks for subject line-based threading only if the email headers match and the emails are threaded. If subject line-based threading is enabled, and if the subject line matches, the emails are threaded. If not, a new conversation is started. To enable subject-line based threading and to change the threading settings, see Configure email threading settings.

When making changes to the subject line, Genesys recommends that you make changes in the middle or end. For example, the following subject line changes do not result in a new thread:

The following subject line changes result in a new thread:

Email can be true spam or incorrectly marked as spam. Genesys Cloud leverages Amazon SES to receive and send email. Amazon SES has various measures in place to detect spam emails and also to detect emails that may contain viruses.

When you configure email addresses for the organization, you can determine how to handle emails that Genesys Cloud detects as spam, which gives you better control over how to process email that Genesys Cloud identifies as spam. For more information, see Add email addresses to the domain in Manage ACD email routing.

Amazon SES provides both spam detection and virus verdicts to Genesys Cloud. If the Amazon verdict indicates that the email may contain a virus, Genesys Cloud disconnects the message and never delivers it to an agent. If the Amazon verdict indicates that the email is spam, Genesys Cloud processes those emails based on the settings you choose when you set up spam routing during email address configuration. For related information, see Malware and antispam protection best practices. 

When you decline or fail to answer an interaction within the Alerting Timeout period, Genesys Cloud returns the interaction to the queue and places you into Not Responding status. An alert appears to the upper right of the user interface, and your profile shows that you are on queue and not responding.

Alerting Timeout is one of many settings your contact center admin sets when they create queues. It determines when the notification for the incoming interaction ends and when Genesys Cloud marks you Not Responding.

While Not Responding, you do not receive new interactions. Declined or not answered interactions reenter the queue.

To resolve the Not Responding status and go back on queue, click Make eligible for interactions. Alternatively, to remove yourself from the queue, click Go off queue.

Interactions can have three timers:

• The incoming interaction alert notification, in the Conversation roster, features a timer that shows the amount of time that the interaction has been in the queue. The blue bar at the top of the interaction alert is a visual indicator of the time remaining until Genesys Cloud marks you as Not responding.
• After you answer an interaction, the timer to the lower right of the interaction card displays the duration of the interaction’s current state. For example, interacting, hold, or after call work.
  Note: If your admin has configured a mandatory time limit, this timer displays the remaining time during after-call-work.
• Above the interaction window, to the right of the contact and channel information Genesys Cloud displays the duration of the selected interaction.

For emails and messages, Genesys Cloud routes the interaction to the previous agent if the agent is on-queue, even if the agent is no longer active in or a member of the queue from which the email or message routed. This behavior is known as last agent routing.

For example:

• A customer sends an email or message to the Technical Support queue.
• ACD email routes the email or message to Agent A in the Technical Support queue.
• Agent A replies to the original email or message.
• Agent A moves from the Technical Support queue and into the Escalated Support queue.
• The customer responds to Agent A’s reply.
• Agent A, while in the Escalated Support queue, receives the email or message from the Technical Support queue. 

You can block specific email addresses from sending emails to your agents. Create an email flow and add a Decision action to your starting state. 

Within the Decision action, use the Email Builder to check the email sender name for the unwanted email address or addresses. If the email address matches the list, configure the action to disconnect those emails. Transfer all other emails to the desired queue.

For more information, see About inbound email flows and About email rules.

ACD email messages and attachments are subject to size limitations. 

Expand allCollapse all

To route to a different location based on a word in the subject line, use the “Contains()” function in a Decision action. For more information, see Navigate an email flow.

To route to a different location based on the domain-part of the sender’s email address, use the EmailAddressDomainPart() function in a Decision. This process might be helpful if you want to send help requests from internal employees to the employee queue, and requests from everyone else to the standard customer queue. For more information, see Navigate an email flow.

In Architect, the limit for string variables is 32000 characters.

If you use your own MAIL FROM domain, you must meet Amazon SES specifications as outlined under the Choosing a MAIL FROM Domain section of Using a Custom MAIL FROM Domain with Amazon SES in the Amazon Simple Email Service Developer Guide.

For more information about adding a custom MAIL FROM domain, see Set up custom MAIL FROM configuration.