Configure authentik email over SMTP

The authentik Email stage sends enrollment verification and password recovery links using the global `AUTHENTIK_EMAIL__*` settings, unless a stage has SMTP settings of its own. `AUTHENTIK_EMAIL__USE_TLS` is STARTTLS (port 587) and `AUTHENTIK_EMAIL__USE_SSL` is implicit TLS (port 465); they're mutually exclusive, so set exactly one to `true`.

1. 1

   Create a send-only key

   In Unitpost, open Settings → SMTP and create a send-only key. AUTHENTIK_EMAIL__FROM defaults to authentik@localhost; set it to an address on a verified domain.

2. 2

   Add the email settings to .env

   With Docker Compose, append these to the .env file next to docker-compose.yml. On Kubernetes, the same settings go in values.yaml.

   Env

   AUTHENTIK_EMAIL__HOST=smtp.unitpost.com
   AUTHENTIK_EMAIL__PORT=587
   AUTHENTIK_EMAIL__USERNAME=unitpost
   AUTHENTIK_EMAIL__PASSWORD=pk_live_...
   AUTHENTIK_EMAIL__USE_TLS=true
   AUTHENTIK_EMAIL__USE_SSL=false
   AUTHENTIK_EMAIL__FROM=authentik@yourdomain.com

   For port 465, set AUTHENTIK_EMAIL__PORT=465, AUTHENTIK_EMAIL__USE_SSL=true and AUTHENTIK_EMAIL__USE_TLS=false.

3. 3

   Redeploy

   The containers read these settings at startup. With Docker Compose, recreate them; on Kubernetes, run helm upgrade with your values file.

   Shell

   docker compose up -d

4. 4

   Send a test with ak test_email

   Run it in the worker container. Add -S and a stage name to test with that Email stage's settings. On Kubernetes: kubectl exec -it deployment/authentik-worker -c worker -- ak test_email you@example.com.

   Shell

   docker compose exec worker ak test_email you@example.com

5. 5

   Check your Email stages

   Stages set to use the global settings pick up the values above. A stage with its own host, port and credentials needs the same Unitpost values entered on the stage.