Notifications — Deliverability

This page is for IT and security teams that need to verify FlowState’s email sending configuration and ensure FlowState emails are not blocked by corporate mail filters.

Sending domain

FlowState sends email from noreply@flowstate.copebit.io. All email is sent via Amazon SES in the eu-central-1 region.

DNS records

The following DNS records are published on flowstate.copebit.io for email authentication.

DKIM

DKIM uses AWS-managed keys via SES Easy DKIM. The actual record shape is:


<dkim-token>._domainkey.flowstate.copebit.io  CNAME  <dkim-token>.dkim.amazonses.com

where <dkim-token> is an AWS-issued value per domain identity, not a fixed selector1/selector2/selector3 naming scheme. AWS rotates the underlying signing keys automatically on a schedule. DKIM signing is applied to all outbound emails by SES.

SPF


flowstate.copebit.io  TXT  "v=spf1 include:amazonses.com ~all"

This authorizes Amazon SES (amazonses.com) to send email on behalf of the domain. The ~all qualifier means that mail from other sources is soft-rejected (marked suspicious rather than rejected outright). If your mail filter requires ~all to be -all, contact support.

Bounce handling

FlowState processes SES bounce and complaint notifications to protect sender reputation and comply with anti-spam requirements.

Event	Action
Hard bounce	Email sending to this address is disabled immediately. The user’s `bounce_state` is set to `hard_bounce`. Recovery is self-service today via the `re_verify_my_email` MCP tool (or `POST /v1/users/me/email/re-verify`) — there is no UI banner or button for this yet.
Soft bounce	`bounce_count` is incremented. Repeated soft bounces will eventually promote the address to `hard_bounce` (same handling as above).
Complaint (mark as spam)	Email sending is permanently disabled. `bounce_state` is set to `complaint`. Re-enabling requires manual review by FlowState support — there is no self-service recovery for a complaint, unlike a hard bounce.

Recovering from a hard bounce

Calling re_verify_my_email() sends a plain delivery-check email to the address on file. There is no code or link to click: the check email actually reaching the inbox is itself the proof the address accepts mail again, and FlowState clears bounce_state automatically the moment SES reports that delivery. The call is a no-op unless the address is currently hard_bounce (it is never re-sent to a complaint address, since that state is permanent), and is rate-limited to a small number of attempts per day.

Email headers

Every FlowState email includes:

List-Unsubscribe (HTTPS URL only — no mailto: alternative, see Unsubscribe) and List-Unsubscribe-Post headers (RFC 8058) for one-click unsubscribe.

There is no Message-ID header and no custom category/tenant header on FlowState mail today. If your mail filter allowlisting depends on a custom header, it will not match FlowState mail currently.

Allowlisting FlowState emails

To ensure FlowState emails are not filtered by corporate mail security systems, allowlist by:

Sending IP ranges: Amazon SES IP ranges (amazonses.com CIDR blocks, published by AWS).
Sending domain: flowstate.copebit.io (or amazonses.com for envelope-from).

There is no custom header to filter on today — see “Email headers” above.

Data residency

SES is regional. FlowState uses the eu-central-1 SES endpoint. Email content is processed and temporarily stored within the EU region. SES does not retain email body content beyond 14 days.