Why we sometimes ask "Was that you?"

Anyone can write any address in the "From" line of an email, the way anyone can write any return address on an envelope. So before YomanAI acts on a request that arrives from your address, such as inviting people or cancelling a meeting, it needs to know the email really came from you.

Most email providers prove this for you, silently, on every message you send. When yours does, we act straight away and never ask. When it doesn't, we hold the request and ask you to confirm it on your dashboard. Nothing happens until you do.

Can I stop being asked?

Yes, and it happens on its own: when you confirm a held email, we also stop asking for the next 30 days. For those 30 days, someone pretending to be you could send YomanAI requests in your name, and it would act on them. After 30 days we start asking again, and you can go back to being asked every time from your Settings page whenever you like.

The lasting fix is for your email provider to start proving your messages, which is usually a one-time setting (below). Once it does, we stop asking by ourselves.

The people you invite are never asked any of this.

For whoever manages your email

YomanAI acts on an emailed request only when the message passes DKIM or DMARC for your address, that is, when it carries a DKIM signature from your own domain (or DMARC says it aligns). Messages without one are acted on for 30 days after you sign in, or after you confirm one we held; otherwise they are held for confirmation. Messages whose signature check fails are always held. Gmail, Outlook.com, Yahoo and iCloud sign every message, so an unsigned one from those addresses is always held.

• Gmail and Google Workspace sign mail automatically for @gmail.com addresses. A Workspace domain signs as itself once DKIM is turned on: Admin console → Apps → Google Workspace → Gmail → Authenticate email → generate a key, publish the TXT record it shows, then Start authentication.
• Microsoft 365 signs by default as yourcompany.onmicrosoft.com, not as your own domain, so your messages don't count as signed by you. To fix it, open the Microsoft 365 Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM → select your domain, add the two CNAME records it shows to your DNS, and then enable signing.
• Other providers: look for "DKIM" in your provider's domain or DNS settings. Adding a DMARC record for your domain is good practice too.

Questions? Write to support@yomanai.app.