Skip to main content

Nexgen V3 outgoing email

Both the paid app (nexgen-backend) and the trial app (nexgen-free-backend) send customer email through Microsoft 365. This page covers the sender identity, the password reset message, and the DNS records that authenticate the mail.

Sender identity​

The Copilot manifests for both backends set the same sender:

  • MAIL_HOST is smtp.office365.com.
  • MAIL_FROM_ADDRESS and MAIL_FROM are noreply@axxya.com, and MAIL_FROM_NAME is Nutritionist Pro.
  • MAIL_USERNAME and MAIL_PASSWORD are secrets in Parameter Store. The login mailbox is a service account, not the sender.

Every message should carry the configured sender. A message sent from the login mailbox instead stands out from the rest and is more likely to be treated as phishing, which is what happened to the password reset email until September 2026.

The password reset email​

A forgot-password request on either site (/forgot-password on the paid app, /password-email-trial on the trial app) writes a new password for the user and emails it. The message has the subject "Your Nutritionist Pro password has been reset" and comes from Nutritionist Pro <noreply@axxya.com>. The subject is the FORGOT_PASSWORD constant in the backend, and the reset-link notification uses the same one.

Two things to know when a customer says the email never arrived:

  • The password is rewritten before the message is sent. If the send fails, the user is locked out with a password they do not know and no error in the UI. Send them a fresh reset rather than asking them to retry the old password.
  • The message used to land in Hotmail and Outlook.com junk folders because it had a bare "Nutritionist Pro" subject and came from the SMTP login mailbox. Both were fixed on 2026-09-15. If it still lands in junk, check the DKIM result below.

SPF, DKIM, and DMARC on axxya.com​

The axxya.com zone is on Cloudflare. It had SPF and DMARC records but no DKIM until 2026-09-15, when the two Microsoft 365 selector CNAMEs, selector1._domainkey and selector2._domainkey, were published. The CNAME targets are the ones Microsoft 365 Defender shows at security.microsoft.com/dkimv2. DKIM signing for axxya.com has to be switched on there as well as in DNS. Microsoft's resolvers lag public DNS, so the toggle can refuse for up to an hour after the records resolve.

To confirm signing works, request a password reset from trial.nutritionistpro.com/forgot-password and look at the received message's headers. Authentication-Results should show dkim=pass with header.d=axxya.com, and the sender should be Nutritionist Pro <noreply@axxya.com>.

The DMARC policy is p=none, so failures are reported nowhere and nothing is rejected. Two optional hardening steps, not done yet:

  1. Add a reporting address so failures are visible, for example v=DMARC1; p=none; rua=mailto:dmarc@axxya.com.
  2. Move to p=quarantine after a few weeks of clean reports.
  • Cloudflare - the nutritionistpro.com zone. The axxya.com zone is a separate site in the same Cloudflare account.
  • Deployment - the Copilot services and their configuration variables.