You have the ability to send emails through the Paradox system from your own Sender Domain. This means that emails will appear to be sent from your email network, but it will actually be sent through the Paradox system without the candidates/recipients knowing it was sent from Paradox. 

There are two ways that email alerts are sent out from the Paradox system:

• Scheduling Communications – This includes calendar event invites, edits, and cancellations for said event. For these communications, you can pick what sender account calendar invites are sent from.
• Other Email Alerts – This includes all other communications outside those listed above, such as those noted in Alert Management. You can pick what sender account these alerts come from. This is an email sender separate from scheduling, but can be impersonated to look like it is the same.

General process

When a service account is connected, all calendar invites will be generated from the entered email address. Users with full access to the Assist permission can complete the below steps.

1. Select All Apps in the top left corner of the header and then Settings from its drop-down menu.
2. When the Settings page opens, select Assist under the Paradox Tools section.
3. By default, the page will open to the Calendar section. Select Outlook or Google based on the email technology of the service account being used.
4. Log in via your email technology's login screen to authenticate the account for Paradox use.
5. Successful connection will show the connected calendar under Link Calendar.

Process for accounts using a calendar integration

If your account has a calendar integration, email impersonation can be configured in the connected Tenant.

1. Select All Apps in the top left corner of the header and then Integrations from its drop-down menu.
2. From the left panel of the Integrations Center, open Connected Apps.
3. Select the ellipses, of the connected app tile to go to Tenant Connection Details.
4. Select the gear icon to open Settings.
   • Note: This setting is also a step when creating a tenant connection (see doc).
5. From the Configure Calendar Invitations setting, select one of three options:
   • Send Calendar Invites from Service Account Email – This option is only visible if a Service Account tenant is connected and enabled for sending invites.
   • Send Calendar Invites from a Different Email – This option connects a dedicated email address by signing in with Outlook.
   • Send Calendar Invites from Paradox Email – This option sends invitations from a default Paradox sender and requires no additional setup.
     
6. If the Service Account Email or Different Email option is selected, the system prompts the user to register DNS records to prevent calendar invitation emails from being marked as spam.
   • Notes:
     • To ensure emails don't get blocked and emails can be sent from your domain, you must add the generated CNAME records to your DNS and ensure the email is verified after you register the CNAME records in your DNS.
     • If you are re/connecting a service account with a new domain, then new CNAME records will need to be generated and registered in your DNS to avoid disruptions.
       
7. Select Confirm.

The configuration in this setting aligns with the configuration outcome in the general process above, meaning updates in either setting will reflect in the other (example, if there is no service account connected in Assist > Calendar, then the option selected in this setting will be Send Calendar Invites from Paradox Email).

Option for accounts using Microsoft Azure/Entra (SMTP)

For teams using Microsoft Azure/ Entra (SMTP), it is possible to add an alias so that the FROM line of service account emails can look as desired. Any calendar invites will then be sent through their original email address but display as the alias email address. 

Your team can update the email address that calendar invites are sent from by following the below steps:

1. Open Microsoft Azure/ Entra.
2. Navigate to the Service Account configuration.
3. Update the Email/SMTP field to the email they want to use for sending calendar invites.
4. Save the page and check to make sure the updated field is stored in the cloud.
5. Disconnect and then reconnect the service account.

This field sets up an alias for the service account. SendGrid will then impersonate this email address instead of the service account email, and when attendees respond to the invite, the messages will be routed to the service account’s inbox which we listen to.

Below are two screenshots of this configuration, but it may look different depending on their version of Azure:

All Other Emails

Paradox leverages SendGrid’s email sending API in order to send all Paradox-application generated emails. This means that email alerts keep your domain or subdomain for the service account (e.g., @clientdomain.com) and require proper registration with your DNS records, or else the emails will be blocked. Learn more here.

This option should be used when your team wants to send email communications outside of scheduling communications from your domain. Users with full access to Assist can complete the below steps.

1. Select All Apps in the top left corner of the header and then Settings from its drop-down menu.
2. When the Settings page opens, select Assist from the Paradox Tools section.
3. From the left panel of the Assist page, select Custom Email Alerts.
4. Input the preferred Sender Name and Email Address.
   • Notes:
     • The domain of the email connected in Assist > Calendar must match the domain of the email in the Sender Email Address field in Assist > Custom Alert Emails.
       • For example, if the email connected in Assist → Calendar is test@clientdomain.com, then the domain in the Sender Email Address field in Custom Email Alerts must be @clientdomain.com. 
     • Anything before the domain is customizable, but the domain (after the @) has to match exactly the domain of the email connected in Assist > Calendar.
5. If you want to use custom DKIM selector, toggle that on.
6. Select Save.
7. The CNAME records will then populate. To ensure emails don’t get blocked, you must add the provided records to your DNS host.
   • Note: After the records are verified, they will no longer populate in this page. Obtaining that data currently requires Paradox product support.
     
8. Once your team has added the CNAME records, select the Verify button at the bottom of the Custom Email Alerts section. If your team has added the records correctly, the Email Status field will update to Verified.
9. Select the Send button and input the desired recipient email to test and make sure that emails are sending correctly.

Experience when email impersonation is not configured

When you do not configure emails to be sent from a custom email address, then the @paradox.ai domain will be used instead. You can, however, request a new Google email address to be created under the Paradox domain (ie. clientname.alerts@paradox.ai). This action requires Paradox product support's assistance in adjusting the name of your email address and updating your Assistant's calendar connection, but it does not require DNS changes from your end.

FAQs

• How does email impersonation work?
  • Email impersonation via CNAME records works by delegating domain authentication authority (such as DKIM and SPF) to an external server. This allows emails generated by an outside platform to pass recipient security checks as if they originated directly from the target domain.
    Adding a CNAME record to your DNS host works like giving an outside system a digital permission slip to send emails under your company's domain name. This record redirects authentication checks from receiving mail servers (like Gmail or Outlook) to a third party's system. Because inbox providers see your domain's explicit sign-off (ie. verified in DNS host), messages are allows through to the inbox, enabling your domain to be impersonated.
    A custom DKIM selector is a unique label assigned to a CNAME record that tells receiving mail servers exactly where to find the cryptographic signature key for a specific email service
• Do I need to do anything with SPF?
  • You do not need to modify your SPF records for Paradox custom email alerts. Although SPF records are a part of the authentication process, you only need to add the CNAME records.
    Sender Policy Framework (SPF) is an email authentication protocol that allows a domain owner to publish a list of IP addresses and mail servers authorized to send emails on behalf of their domain.
• Why is there no CNAME records on the Custom Email Alerts page?
  • If the email status is Verified, the records will no longer populate in this page.
    That data for an account will need to be obtained from Paradox product support.
• Why are my scheduling emails coming from a different address than other email alerts?
  • Scheduling emails come from the address configured in Assist > Calendars, not Assist > Custom Email Alerts. This defaults to the service account if one is connected, but it can be set to impersonate anything.
    The Assist Calendar and Assist Custom Email Alerts should come from the same domain if impersonating your domain. This is because the DNS records you add when setting up Assist Custom Email Alerts gives Paradox the permission to send from that domain, so Calendars has to use the same one.
• Can I have multiple email impersonations configured? Can I use different sender emails for different brands?
  • No, only have one email impersonation can be configured for scheduling communications or alerts.
    Multiple tenants can be connected (ie. integration getting user calendar data), but calendar invites can only send from a single service account.
• How does the O365 connection affect email impersonation?
  • CNAME records can be generated for the invite sender email separate from the custom email alerts. So an account can send emails from sender1@clientdomain.com for scheduling comms (CNAME records populate in Connected Apps), and for all other communications from sender2@clientdomain2.com (CNAME records populate in Assist > Custom Email Alerts).