Email-to-form

Give a form its own email address. Forward a message to it and the message becomes a submission — attachments attached, sender verified, workflow fired — exactly as if someone had filled the form in.

Minting an address

In the builder's Share tab, beside the public link, the Email a form panel mints an address of the shape s-…@in.faldaro.com. The local part is an unguessable token rather than the form's name, the public-link discipline applied to mail: the address space cannot be walked, and an address that has spread too far is retired by rotating it — the old one stops working immediately. Creating one takes the same permission as publishing a public link, because it is the same decision: opening the form to input from outside your organisation. Email-to-form is included in the Team plan and above.

Who may send — and the empty list

Every address carries an allowlist, and an empty allowlist refuses everyone. That is the deliberate starting state, not an oversight: an address that accepted mail the moment it existed would be an open relay into your forms. Add at least one sender before forwarding anything, and check the allowlist first whenever mail seems to vanish.

An entry containing @ admits one mailbox; an entry without admits a whole domain. Either way the sender is checked against what their mail proved, never against the From header on its own — a From header is text anyone can type. A message qualifies when its sending domain passes SPF or carries a DKIM signature, and that authenticated domain matches the From address — the same alignment rule DMARC uses.

Practically: the sending domain must publish an SPF record, or sign its mail as itself. A personal Gmail account works by allowlisting the address or gmail.com — Google signs its users' mail as gmail.com. A company domain on Google Workspace or Microsoft 365 should publish SPF (one TXT record naming its provider) and ideally switch on DKIM in its admin console; until it does, its mail authenticates the provider rather than the company, and Faldaro will say exactly that in the review queue rather than accepting a claim nothing backed.

Where the message lands

Each address maps the parts of a message onto the form's own fields: the subject, the message body and the sender's address onto text fields, the received date onto a date field, and attachments onto a file field — real files on the submission, same as an upload. Every mapping is optional, and the pickers only offer fields of the right type on the live version.

With AI switched on for the address — it is, unless you turn it off — the rest of the form is read out of the message itself: “new claim for the Henderson job, $4,200, needs doing by the 14th” lands on client, amount and due date. The model may only fill fields the form actually declares, values are coerced to each field's own type, choice fields only accept their published options, and anything it could not place is noted on the message for you to see. Your explicit mappings always win over the extraction — configuration is a statement of intent, an extraction is a guess. Extraction costs AI credits per message, like every AI feature; the deterministic mappings cost nothing.

The submission then behaves like any anonymous submission: validation runs, formulas are computed on the server, the workflow starts, notifications and integrations fire, and an on-submission agent triages it under the same guardrails a public submission gets.

The review queue

Nothing is dropped silently. Inbound mail in the sidebar lists every message with what its sender proved — SPF, DKIM and the aligned domain — and what became of it. A message that could not be filed is held, with the reason in plain words: the sender was not on the allowlist, nothing authenticated the sending domain, the data failed the form's own validation, the organisation ran out of AI credits. Fix the cause — add the sender, publish the SPF record, top up — and press Retry; the message is still there, and retrying can never file it twice. Discarding deletes the original for good. Until then, the original .eml can be downloaded from any message's detail view.

What it deliberately will not do

Automated mail — auto-replies, out-of-office, bulk — is never processed, so two systems cannot mail each other in a loop. A form whose rules price a payment cannot be filed by email: nobody is present to pay, so the message is held and says so. Extraction reads text; a scanned, image-only PDF has none to read, and a message it cannot understand is held visibly rather than guessed at. Messages are capped at 25 MB with up to twenty attachments.