# Can Tines interact with email - parsing, sending, and triaging? **URL:** \ **Category:** Tines Stories: Ask + Answer\ **Created:** [June 30, 2026, 2:52pm UTC](https://community.tines.com/t/can-tines-interact-with-email-parsing-sending-and-triaging/64 "2026-06-30T14:52:05Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![sapling](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/sapling/32/36_2.png) [@sapling](https://community.tines.com/u/sapling)\ **Post date:** [June 30, 2026, 2:52pm UTC](https://community.tines.com/t/can-tines-interact-with-email-parsing-sending-and-triaging/64/1 "2026-06-30T14:52:05Z")
A surprisingly large part of our security workflow still runs through email, things like phishing reports, vendor alerts, and approval chains. I’m wondering how well Tines handles email as both an input and an output. Can it receive and parse incoming emails, and is sending formatted emails straightforward? Curious what’s possible here. ---
**Author:** ![Angie](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/angie/32/44_2.png) [@Angie](https://community.tines.com/u/Angie)\ **Post date:** [July 10, 2026, 8:32pm UTC](https://community.tines.com/t/can-tines-interact-with-email-parsing-sending-and-triaging/64/2 "2026-07-10T20:32:46Z")
Tines handles email in both directions, and it’s a genuinely common pattern, so you’re in good company here. 😊 ### Incoming email The **Receive Email action** is your entry point, and it works in two modes: - **Email mode (the easy one):** Tines generates a unique email address on the action. Anything sent to that address triggers the workflow, so analysts can just forward suspicious emails straight in. No server setup required. - **IMAP mode:** the action watches an existing IMAP mailbox and fires when new mail arrives, handy if you want to monitor a shared inbox like `phishing@yourcompany.com`. Either way, the email content, subject, sender, and any attachments all come through as structured data in the story, ready for parsing and routing. Attachments arrive Base64-encoded, so you can pass them straight to something like VirusTotal for analysis. That’s exactly what makes phishing triage so straightforward to build. ### Outgoing email Tines has a built-in **Send Email action** that supports HTML formatting (there’s an HTML editor built in), attachments, and dynamic content pulled from your story data. You can set the reply-to address, sender name, CC, subject, and body. By default it sends from `mail@tines.io`, but there’s a custom sender email address feature (powered by Amazon SES) if you need mail to come from your own domain. And if you want tighter control, you can always send via an external provider like SendGrid or Microsoft 365 through their APIs using an HTTP Request action. ### Getting started Email-based phishing workflows are one of the most popular use cases in Tines, so there’s a lot to borrow from: - The [Tines Story Library](https://www.tines.com/library) has phishing triage templates worth exploring. - The Tines Docs cover both the [Receive Email action](https://www.tines.com/docs/actions/types/receive-email) and the [Send Email action](https://www.tines.com/docs/actions/types/email) in detail, including how attachments and files flow through ([Working with files](https://www.tines.com/docs/actions/working-with-files)). - [Tines University](https://www.tines.com/university) has guided exercises that walk through email-based workflows. ---
**Author:** ![system](https://dub1.discourse-cdn.com/tines/user_avatar/community.tines.com/system/32/232_2.png) [@system](https://community.tines.com/u/system)\ **Post date:** [July 13, 2026, 11:03am UTC](https://community.tines.com/t/can-tines-interact-with-email-parsing-sending-and-triaging/64/3 "2026-07-13T11:03:31Z")
This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.