A connected email account in NimbusOS is more than a pile of credentials. It is a live EmailAccountHealth row with a reputation score, a daily send budget, a warmup stage, and a rotation priority. The platform treats every inbox as an independent unit that can be promoted, demoted, or pulled out of rotation without affecting the rest of the fleet. This article walks through the four connection paths and explains what happens in the database and in the deliverability brain once an account is live.
The Four Connection Paths
Four supported paths cover nearly every real world fleet.
Gmail and Google Workspace via OAuth
For a single Gmail mailbox or a Google Workspace seat, use the OAuth flow. Go to /email-accounts, click Connect Account, choose Gmail. You will be redirected to Google's consent screen with the minimum scopes required: gmail.send, gmail.readonly for reply sync, and profile to pull the display name.
On consent, NimbusOS stores an encrypted OAuth token pair. The access token is refreshed automatically through a Celery task. Passwords are not stored; if the token is revoked from the Google side, the account is flagged unhealthy on the next send attempt and pulled from rotation until reauthorized.
Daily send limit starts at 40 for a new Google Workspace seat and 20 for a new consumer Gmail, because consumer Gmail has stricter unauthenticated bulk rules. Those numbers are editable in the account detail page.
Microsoft 365 via OAuth
Same OAuth pattern for Microsoft 365. The scopes requested are Mail.Send, Mail.Read, and User.Read. If your organization uses Azure AD with conditional access policies, an admin may need to grant consent for the NimbusOS app before a user can connect. Microsoft exposes the app registration in the Azure portal by its client ID which is listed on the connection screen.
Daily send limit on a fresh Microsoft 365 seat starts at 30. Microsoft's Exchange Online throttling is looser than Google's in the first week but tightens faster if reputation slips, so the ramp is slightly more conservative.
SMTP and IMAP with Custom Credentials
For a mailbox hosted outside Google or Microsoft, use custom SMTP and IMAP. You will enter the SMTP host, port, encryption mode (SSL, STARTTLS, or none), username, and password. The IMAP fields are symmetric.
Credentials are encrypted at rest with Fernet. The encryption key is workspace scoped and rotated on a schedule. A read of the credentials requires both the database row and the workspace key, so a database dump alone is not sufficient to extract the plaintext.
On save the platform runs a connection test. It sends a one line test message to an internal NimbusOS address and reads the response from the IMAP side. If either leg fails, the account is not saved and the specific error (auth failure, connection timeout, TLS handshake failure) is shown in plaintext.
ReachInbox Account Import
If you already run a ReachInbox fleet, the fastest path is to import the entire fleet in one click. Paste your ReachInbox API key in Integrations, click Sync Accounts, and every ReachInbox inbox becomes an EmailAccountHealth row with its current warmup status, reputation, and send budget.
From then on, sends through these inboxes are proxied through ReachInbox. NimbusOS holds the campaign definition, the scoring logic, the reply classification, and the analytics; ReachInbox holds the send execution.
What EmailAccountHealth Actually Tracks
Every connected inbox becomes an EmailAccountHealth row. The fields that matter most are:
overall_score (0 to 100). Composite health index. Read first in every rotation decision.
reputation_score (0 to 100). Reputation piece of the composite. Drawn from Gmail Postmaster, Microsoft SNDS, Yahoo FBL, and recent bounce and complaint signals.
warmup_progress (0 to 100, cosmetic only). A rough "how far through warmup is this inbox" number for the dashboard. The actual stage that gates sending is computed separately.
current_stage (0 to 5). Integer stage from get_inbox_stage(). Stage 0 is brand new. Stage 3 is the cold outreach gate. Stage 5 is full cold outreach clearance with production volume.
daily_send_limit (integer). Per inbox daily cap. Starts conservative and ramps over warmup.
bounce_rate_7d (float, 0 to 1). Rolling bounce rate over the last 7 days.
complaint_rate_7d (float, 0 to 1). Rolling spam complaint rate.
is_active (boolean). Paused accounts are not inactive; they are still tracked but excluded from rotation.
Rotation and Health Floors
When a campaign sends, the sequence engine queries the campaign's sending pool for an eligible EmailAccountHealth. Eligibility is a set of filters.
Active. is_active=true.
At or above the minimum health score. Every campaign has a min_health_score field. Default is 70. Rotation skips inboxes below the floor.
Has remaining budget today. sends_today < daily_send_limit.
Stage eligible for the campaign type. Cold outreach campaigns require stage 3 or higher. Nurture campaigns require stage 2 or higher.
Not in cooldown. After certain events (like a bounce burst or a complaint), an inbox enters a cooldown. The cooldown clock is visible on the account detail.
The first eligible inbox serves the send. The counters update. If no inbox is eligible, the send is deferred to the next batch window with a log entry explaining why. The campaign is not marked failed; it is marked throttled, which is visible in the deliverability dashboard.
Warmup Enrollment
New inboxes start in warmup. Warmup is documented in its own article, but three things are worth knowing here.
Warmup sends are generated and received by a partner network that NimbusOS runs with ReachInbox. A new inbox sends a small number of conversational emails per day and receives the same number back. The replies are opened, read, and responded to, which builds sender reputation signal with the ISPs.
Warmup escalation is stage based, not day based. An inbox does not graduate to stage 3 because it is 14 days old. It graduates because cumulative warmup sends exceed the stage threshold and the reputation indicators are healthy.
Warmup is paused automatically if bounce_rate_7d or complaint_rate_7d cross a threshold. A paused warmup does not graduate until the problem clears. This is how the platform protects a fleet from promoting a poisoned inbox into cold sending.
Multiple Inboxes per Domain
It is common for cold outreach domains to host five to ten inboxes. NimbusOS supports this directly. On the account connect screen, if the domain is already in the platform's DomainHealth table, the new inbox links to the same domain record automatically. All inboxes on the same domain share DNS health, blacklist status, and domain level reputation.
A domain wide problem (for example, DMARC alignment failure) pauses every inbox on that domain until resolved. This prevents the common mistake of assuming one healthy inbox is safe to send from when its domain is on a blacklist.
Per Account Limits That Are Not Just Send Limits
In addition to daily_send_limit, each inbox can carry campaign type restrictions. A common agency pattern is to reserve one inbox per domain for nurture only, and the rest for cold outreach. The nurture inbox never sends to cold contacts, which keeps its reputation insulated.
Restrictions are configured on the account detail page. They are enforced at send time. A campaign that tries to route a cold send through a nurture only inbox is deferred rather than sent.
Troubleshooting
"Authentication failed" on connection. The credential is wrong, or the mailbox requires an app password rather than the user password. Gmail with 2FA requires an app password. Google Workspace with 2SV requires an app password unless OAuth is used.
"TLS handshake failure" on connection. The SMTP server is rejecting the TLS version the client is offering. Try switching between STARTTLS and SSL on port 465. For legacy servers, contact support; NimbusOS supports older TLS versions but they are off by default.
"Account shows healthy but sends are not going out." Check the campaign's min_health_score against the account's overall_score. The most common cause is a campaign with a default floor of 70 and an account at 68.
"Warmup is paused and will not resume." Check bounce_rate_7d and complaint_rate_7d. If either is elevated, the underlying issue must be fixed first. Run an email verification job on the address book that sent from this inbox, or investigate whether a shared IP neighbor is affecting the domain.
"Account connected but reply sync is empty." The IMAP credentials are wrong or the IMAP folder is misnamed. Outlook in particular labels its inbox folder differently depending on locale. Check the folder name in the account detail page.
Frequently Asked Questions
Does NimbusOS send directly from my inbox or through a relay?
It depends on the connection path. Gmail and Microsoft 365 OAuth sends go directly through the provider's API. Custom SMTP sends go through the SMTP server you configured. ReachInbox imports send through ReachInbox, which has its own relay infrastructure.
Can I connect an inbox to more than one campaign?
Yes. An inbox belongs to as many campaigns as you add it to. The campaign type restrictions on the inbox are checked before rotation, so an inbox that is reserved for nurture will only serve nurture campaigns, even if it is in a cold outreach pool.
How do I remove an inbox from rotation without deleting it?
Set is_active=false. The inbox remains in the database with its history intact but is skipped by rotation. You can flip it back on later without re-authenticating.
Is there a limit on how many inboxes I can connect?
Soft limit of 1000 per workspace on the default plan. Hard limit only applies at the enterprise tier and is configured per contract. Most agency fleets run 50 to 500 inboxes.
Can I connect an inbox that is also used for personal email?
Yes, but the daily send limit will cap automatically based on Google's or Microsoft's provider ceiling for a personal mailbox. We recommend dedicated outbound inboxes on dedicated sending domains for any real volume.
What to Read Next
After connecting accounts the essential next steps are Email Warmup to understand the stage engine, BYOSMTP Configuration if you are bringing custom SMTP credentials, and Deliverability Overview to learn the alerts that will fire when an account slips.