# Email integration

Some tools can only send email. The **Email** integration gives you a unique inbound address: every email sent to it opens an alert, and a follow-up email saying the problem recovered resolves it. No webhook is needed.

## Set it up

:::steps
### Create the integration
In EvoHub, go to **On-Call → Integrations → + Add Integration**, choose **Email**, pick an **Escalation Policy** and click **Create Integration**.
### Copy the inbound address
EvoHub shows "Integration created! Send alert emails to this address:" with the address. You can copy it again later from the integration's **Inbound email address** field.
### Use it as the alert recipient
In your monitoring tool, add the address as the recipient of its alert emails.
### Send a test
Send a test email from the tool (or from your own mailbox) and check that an alert appears in **On-Call → Alerts**.
:::

Each email integration has its own address, so you can create one per tool and route each to a different escalation policy.

## What EvoHub reads

| EvoHub alert | Taken from |
| --- | --- |
| Title | The email subject (or "Email alert" if empty). |
| Description | The plain-text body. For HTML-only emails, the text with the HTML tags removed. |
| Severity | Always **high**. Email carries no reliable severity, so EvoHub does not guess one. |
| Fingerprint | The subject in lower case, with status words (such as DOWN, UP, ALERT, RESOLVED, CRITICAL, IS, BACK) and brackets, parentheses, colons and hyphens removed. Status words are removed only as whole words, so "Backup" and "this" stay as they are. Each email integration keeps its own fingerprints. |

## Auto-resolve

An email is treated as a recovery when its subject or body contains any of these phrases as whole words (case does not matter):

`resolved`, `recovered`, `is up`, `back up`, `is back`, `cleared`, `has recovered`, `up again`, `ok again`, and `no longer` followed by `down`, `failing`, `firing`, `alerting`, `critical`, `in alarm`, `unhealthy` or `degraded`

Whole words only: "unresolved", "this backend" or "is upgraded" do not count, and neither does a plain "no longer responding".

A recovery email does not open an alert. It resolves the open alert of the same integration whose fingerprint matches — so `[DOWN] api.acme.example` is resolved by `[UP] api.acme.example is back up`, because both subjects reduce to the same fingerprint.

> [!WARNING]
> The recovery check looks at the body as well as the subject. If your tool's problem emails contain one of those phrases in their body (for example a footer such as "This alert will be resolved automatically"), they are read as recoveries and no alert opens. Remove the phrase from the tool's email template, or use a webhook integration for that tool.

## Deduplication

While an alert is open, more emails to the same integration with the same subject (after status words are removed) are recorded as **Retriggered** on that alert instead of opening new ones. The same subject sent to two different email integrations opens two separate alerts. Within one integration, different monitors should have different subjects, for example by including the monitor or host name.

## Security

- The address contains a random token and is not guessable. EvoHub does not check the sender, so anyone who knows the address can open alerts. Share it only with the tools that need it.
- To stop accepting email, **Disable** the integration. To retire an address, **Delete** the integration and create a new one.
- Emails to an address that does not belong to an enabled integration are ignored.

## Related

- [Integrations overview](https://docs.evohub.io/integrations-overview.md)
- [Alert API and generic webhook](https://docs.evohub.io/generic-webhook.md)
- [Alerts and incidents](https://docs.evohub.io/alerts-and-incidents.md)