<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D5WR000021laEl0AIOkta Classic EngineCustom Email DomainAnswered2026-08-21T02:27:36.000Z2026-08-20T11:28:04.000Z2026-08-21T02:27:36.000Z

Natrajk.60356 (Customer) asked a question.

19h ago

Custom Email Service Integration in okta

Hi,

 

We are looking to integrate a custom email service with our Okta tenant.

We currently manage multiple domains and subdomains, all of which use Okta as the email provider. However, we would like to configure a new custom email service for one specific client brand while continuing to manage the other domains and subdomains through our existing setup.

 

Could someone please guide us through the process and share the required configuration steps, DNS records, and any Okta-related settings needed for this integration?

 

Thank you.

 

 

  • 3 answers
  • 20 views

  • Mihai N. (Okta, Inc.)

    Okta has two distinct email configuration systems that operate at different levels:

     

    1. Brands → Domains → Custom Email Templates (Brand/Domain Level): This system allows you to customize the appearance and content of email templates for specific brands and domains. Each brand can have its own custom domain, and when users interact with Okta through that domain, they receive emails styled according to that brand's templates. This is primarily a visual and content customization layer.
    2. Email Provider → Custom Email Provider with SMTP (Tenant Level): This system controls the underlying email delivery mechanism, which SMTP server actually sends the emails. When you enable a custom SMTP provider in the Email Provider section and toggle it on, you are changing the email delivery infrastructure for the entire tenant, not just a specific brand or domain.

     

    Key Difference:

    The critical distinction is scope:

    • Brands/Domains customization = Which email template design and content is used (visual layer)
    • Email Provider/SMTP = Which email server sends the emails (delivery layer)

     

    Why the Toggle Affects All Domains:

    When you enabled the custom SMTP provider toggle in Email Provider, it changed the email delivery mechanism tenant-wide because Okta's Email Provider settings are configured at the tenant level, not the brand or domain level. This means all domains and subdomains under all brands now route their email delivery through your custom SMTP provider instead of Okta's default email service.

     

    Can Email Provider Be Restricted to Specific Domains?

    Currently, Okta's Email Provider configuration does not support domain-level or brand-level restrictions. The SMTP provider setting is a tenant-wide setting, it applies to all email sent from your Okta organization, regardless of which brand or domain the user is accessing. There is no built-in toggle or setting to restrict a custom email provider to only one brand or domain while keeping others on Okta's default email service.

     

    Workaround Considerations:

    If you need different email providers for different brands or domains, you would need to:

    • Contact Okta Support to discuss custom configuration options or feature requests
    • Consider using a single SMTP provider that can route emails based on recipient domain or other criteria
    • Evaluate whether your SMTP provider (e.g., SendGrid, Mailgun) offers routing rules that could differentiate email handling by domain

     

    Application-Level Configuration (OIDC/SWA):

    Email configuration in Okta is handled entirely at the tenant and brand level, not at the individual application level. OIDC and SWA applications do not have separate email settings. When a user is assigned to an application and triggers an email event (activation, password reset, MFA enrollment, etc.), the email is sent according to:

    1. The brand associated with the domain the user accessed
    2. The Email Provider setting configured at the tenant level

    No configuration is required or available at the OIDC or SWA application level for email delivery.

     

    Recommendation:

    If you need to use different email providers for different client brands, open a support case to discuss:

    • Whether domain-level email provider restrictions are available in your org
    • Custom configuration options for multi-tenant email routing
    • Whether your use case qualifies for a feature request or custom implementation

    Please follow up with Okta Support to confirm the current capabilities and limitations for your specific scenario.

     

     

     

    Regards.

    --

    Help others in the community by liking or hitting Select as Best if this response helped you.

    Collect them all. Learn a new skill and earn a new Okta Learning badge.

    Just released: More Okta Community badges just added

    Expand Post
    Selected as Best

  • Mihai N. (Okta, Inc.)

    Hi @Natrajk.60356 (Customer)​ , Thank you for reaching out to the Okta Community! 

     

    The key principle is that Okta determines which brand and email configuration to use based on the request host (the domain in the URL). Each brand must be associated with a unique custom domain, and when users interact with Okta through that domain, they receive emails styled and configured for that brand.

     

    Step 1: Create a New Brand for the Client

    1. Navigate to Customization → Brands in the Okta Admin Console.
    2. Click Add Brand.
    3. Enter a name for the brand (e.g., "Client Brand" or the specific client name).
    4. Configure the brand appearance (logo, colors, etc.) as needed for the client.
    5. Save the brand.

     

    Step 2: Add a Custom Domain for the New Brand

    1. Navigate to Customization → Domains.
    2. Click Add Domain.
    3. Enter the custom domain you want to use for this client (e.g., login.clientbrand.com).
    4. Select the brand you just created from the Brand dropdown.
    5. Note the DNS records (TXT and CNAME) that Okta provides, you will need to add these to your domain registrar.

     

    Step 3: Configure DNS Records

    1. Log in to your domain registrar (GoDaddy, Route 53, Cloudflare, etc.).
    2. Add the TXT record provided by Okta to prove domain ownership. This typically validates that you control the domain.
    3. Add the CNAME record provided by Okta to route traffic to Okta's servers.
    4. Allow time for DNS propagation (typically 15 minutes to 48 hours, depending on your registrar's TTL settings).
    5. Return to Okta and click Verify to confirm the DNS records are in place.

     

    Step 3: Configure Custom Email Templates for the Brand

    1. Navigate to Customization → Brands → [Your New Brand] → Emails.
    2. Customize the email templates (activation, password reset, MFA, etc.) with the client's branding, colors, and messaging.
    3. Test the email templates using the Send Test Email button.

     

    Step 4: Ensure Branded Emails Are Sent

    • For API-driven user creation: Use the Okta API to create users and trigger activation emails, specifying the custom domain associated with the client brand. This ensures the activation link and email use the correct brand.
    • For Admin Console user creation: Emails sent from the Admin Console typically use the default brand. If you need branded emails for users created manually, use the API instead.

     

    Step 5: Keep Your Existing Setup Intact

    • Your existing domains and subdomains will continue to use the default brand or their existing brand associations.
    • The new custom domain and brand you created will only affect users and workflows that interact with Okta through that specific domain.
    • No changes are required to your current email configuration for other domains.

     

    Important Notes:

    • Okta uses the request host (the domain in the URL) to determine which brand's emails to send. Users must access Okta through the custom domain to receive branded emails.
    • If you are using an external email service provider (such as SendGrid or Mailgun) instead of Okta's built-in email system, you will need to configure SMTP credentials and additional settings. This requires a separate setup process and should be verified with Okta Support for your specific email provider.
    • Test the configuration in a preview or test environment before deploying to production.

     

    Reference Documentation:

     

    We can provide general guidance and documentation, but in-depth troubleshooting is outside of the Okta Community forum scope. 

    If you have an account with us and are a SuperAdmin/Case Admin, please open a case to work with my colleagues from the Support Team to discuss this implementation further. They'll be able to access additional tools and resources to help you get set up.  

     

     

     

    If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

     

    Hope my answer helps! 

     

    --

    Help others in the community by liking or hitting Select as Best if this response helped you.

    Collect them all. Learn a new skill and earn a new Okta Learning badge.

    Just released: More Okta Community badges just added

    Expand Post

    • Natrajk.60356 (Customer)

      Could you please clarify the difference between these two options in the Okta tenant?

      1. Brands → Select Domain → Domains → Add Custom Domain & Email
      2. Email Provider → Use Custom Email Provider → Require SMTP Details (toggle option to use this email provider for domain level)
      3. When I configured the Email Provider → SMTP setup and enabled the toggle, I noticed that the email provider for all domains and subdomains under Brands changed from Okta to Custom Provider.
      4. can it be restricted to a specific domain/brand?

       

       

      Also, is it required to update/configure these settings at the Okta application level (OIDC/SWA), or are they configured only at the tenant/brand level?

      Expand Post

      • Mihai N. (Okta, Inc.)

        Okta has two distinct email configuration systems that operate at different levels:

         

        1. Brands → Domains → Custom Email Templates (Brand/Domain Level): This system allows you to customize the appearance and content of email templates for specific brands and domains. Each brand can have its own custom domain, and when users interact with Okta through that domain, they receive emails styled according to that brand's templates. This is primarily a visual and content customization layer.
        2. Email Provider → Custom Email Provider with SMTP (Tenant Level): This system controls the underlying email delivery mechanism, which SMTP server actually sends the emails. When you enable a custom SMTP provider in the Email Provider section and toggle it on, you are changing the email delivery infrastructure for the entire tenant, not just a specific brand or domain.

         

        Key Difference:

        The critical distinction is scope:

        • Brands/Domains customization = Which email template design and content is used (visual layer)
        • Email Provider/SMTP = Which email server sends the emails (delivery layer)

         

        Why the Toggle Affects All Domains:

        When you enabled the custom SMTP provider toggle in Email Provider, it changed the email delivery mechanism tenant-wide because Okta's Email Provider settings are configured at the tenant level, not the brand or domain level. This means all domains and subdomains under all brands now route their email delivery through your custom SMTP provider instead of Okta's default email service.

         

        Can Email Provider Be Restricted to Specific Domains?

        Currently, Okta's Email Provider configuration does not support domain-level or brand-level restrictions. The SMTP provider setting is a tenant-wide setting, it applies to all email sent from your Okta organization, regardless of which brand or domain the user is accessing. There is no built-in toggle or setting to restrict a custom email provider to only one brand or domain while keeping others on Okta's default email service.

         

        Workaround Considerations:

        If you need different email providers for different brands or domains, you would need to:

        • Contact Okta Support to discuss custom configuration options or feature requests
        • Consider using a single SMTP provider that can route emails based on recipient domain or other criteria
        • Evaluate whether your SMTP provider (e.g., SendGrid, Mailgun) offers routing rules that could differentiate email handling by domain

         

        Application-Level Configuration (OIDC/SWA):

        Email configuration in Okta is handled entirely at the tenant and brand level, not at the individual application level. OIDC and SWA applications do not have separate email settings. When a user is assigned to an application and triggers an email event (activation, password reset, MFA enrollment, etc.), the email is sent according to:

        1. The brand associated with the domain the user accessed
        2. The Email Provider setting configured at the tenant level

        No configuration is required or available at the OIDC or SWA application level for email delivery.

         

        Recommendation:

        If you need to use different email providers for different client brands, open a support case to discuss:

        • Whether domain-level email provider restrictions are available in your org
        • Custom configuration options for multi-tenant email routing
        • Whether your use case qualifies for a feature request or custom implementation

        Please follow up with Okta Support to confirm the current capabilities and limitations for your specific scenario.

         

         

         

        Regards.

        --

        Help others in the community by liking or hitting Select as Best if this response helped you.

        Collect them all. Learn a new skill and earn a new Okta Learning badge.

        Just released: More Okta Community badges just added

        Expand Post
        Selected as Best

Loading
Custom Email Service Integration in okta