Why a reply you emailed in is waiting to send — Help

A lead replies while you are on the road. The notification lands on your phone, you thumb out an answer straight from your mail app, and 1pm passes it on to the client for you. That still works exactly as it did.

What changed is that the reply no longer goes out the second you hit send. It waits in an outbox for up to four hours, and 1pm emails you a copy of what is about to leave, with a button that sends it immediately. Read it back, tap once, and it goes.

This article explains why the wait is there, the email you get, the two kinds of hold, and how to release or stop one from your phone or from the app.

The short version

Reply to a lead notification from your own mail app and your reply is held, not sent.
You get an email straight back, "Your reply to Sally is in your outbox", carrying the full text of what will go out.
Tap Send this reply in that email, confirm on the page it opens, and the client has it. No signing in.
Do nothing and, if we could confirm the reply really came from your email domain, it sends itself after four hours. If we could not, it waits until you send it.
The same reply sits in the lead's thread in the app with Send now and Cancel beside it.

Replies you type in the app are untouched by all of this. They still go after the usual fifteen second undo window.

Why a reply you emailed in waits

Two reasons, and they pull in the same direction.

The honest one first. When an email arrives claiming to be from you, the only thing saying so is the From line, and a From line is free to write. 1pm matches it against the addresses on your account, which is the right check to make, but it is not proof. So instead of relaying a message straight to your client on the strength of a header, we hold it and show it to you.

The hold does not make that check any cleverer. What it does is make sure a message you never wrote cannot reach your client while nobody is looking. If a reply turns up in your outbox saying "our bank details have changed", you will notice, because you did not write it. That is the entire point, and it is why the notice carries the whole message rather than the first line of it.

The second reason is that it is useful. Replying from a phone is how you get the typo, the wrong name, and the attachment you meant to add and forgot. The fifteen second window in the app was never any help to somebody typing on the move. Four hours is.

The email you get

It arrives within a minute of your reply and goes to the address you replied from, not to the account owner and not to your notification inbox. The person who needs to see it is whoever typed it.

It contains:

The subject the client will see, which is the thread's own subject rather than the "Re: New reply from Sally" your mail app wrote.
The full text of your reply. Not a preview, not the first few lines.
The names of any files you attached.
A Send this reply button.
The address it was accepted from, at the bottom, next to a line saying why we are asking.

That last line is the tripwire. On almost every one of these the sender is you and the address is your own, so it reads as an outbox receipt and nothing more. On the day one arrives for a reply you did not write, the address sitting under a message you have never seen is the tell.

Sending it from the email

Send this reply opens a small page showing the message one more time, with Send it now and Cancel this reply. There is no sign-in, which is the whole point: you are on the road, and "log in to release it" hands you back the exact problem that replying from your inbox exists to solve.

A few things about that page worth knowing:

The button in the email opens the page, it does not send. Opening it is safe. Corporate mail filters (Safe Links, Mimecast and similar) fetch every link in an incoming email before you ever see it, and if the link itself sent the reply, those scanners would be releasing your held messages for you. Nothing happens until you press a button on the page.
The link works once. Once you have sent or cancelled, opening it again just tells you what happened.
It expires after seven days. After that, release it from the app instead.
It is safe to be in an email because it goes to the address we matched, never the one the message typed. Somebody can forge a From line, but they cannot read mail sent to your real inbox, so a forged reply posts its release link to you rather than to them.

If we could not generate that link for some reason, the notice still arrives and points you at the lead in the app instead.

The two kinds of hold

Every relayed reply is held. What differs is whether it sends itself at the end of the hold.

Held and sending at a time. We were able to confirm that the reply really did come from your email domain, so the notice says when it goes ("It goes to [email protected] at 3:42pm", in your account's time zone) and the thread says the same. Do nothing and it sends. The button that matters here is Cancel, for the case where it was not you.

Held until you send it. We could not confirm it. The notice says plainly that it will not go until you send it, no time is quoted anywhere, and no send is scheduled. It leaves only when a person presses a button.

The second one is not an accusation. When mail leaves your provider it can carry a signature proving the domain it claims to come from really sent it, and plenty of perfectly ordinary businesses have never had that switched on. That is not a fault, and it does not mean your reply is suspect. It means we have nothing to check against, so we check with you.

If you would like your phone replies to release themselves, that is a change at your own email provider rather than a setting in 1pm, and it is a short one. The next section has the records.

If you reply from a plain gmail.com or outlook.com address rather than your own domain, this is already handled for you and your replies will be sending themselves. Those domains publish the records already.

This is a separate thing from verifying your sending domain in 1pm. That one governs the address your replies go out from, and it does not publish the record described below. This one is about the mail your provider sends in to us.

Making your replies release themselves

There are two ways a message can prove it really came from your domain, and either one on its own is enough for this check. Both are the same records that keep your ordinary business email out of other people's spam folders, so neither is wasted effort.

Turn on DKIM at your email provider. DKIM adds a signature to every message you send, and the signature names the domain that vouched for it. What matters for this check is that it signs with your domain rather than your provider's, which is the part that is often left switched off. In Google Workspace the setting is called Authenticate email and you generate a key, publish the TXT record it hands you, then come back and start authentication. In Microsoft 365 it is under DKIM in the Defender portal, where you add two CNAME records for your domain and then enable it. Both providers keep their own step-by-step guide current, so search their admin help for "DKIM" rather than working from a screenshot.

Or publish a DMARC record. This is one TXT record at your DNS host, wherever you manage your domain:

Name: _dmarc.yourdomain.com, replacing yourdomain.com with your own. Some DNS hosts add the domain for you, in which case enter just _dmarc.
Type: TXT
Value: v=DMARC1; p=none;

p=none is the monitor-only setting. It asks receiving mail providers to take note of what they see and changes nothing about how your mail is treated, so publishing it cannot cost you a delivered email. It is enough for our check as long as the SPF record letting your provider send for you is already in place, which it will be if your ordinary business mail is arriving.

Do not jump straight to p=quarantine or p=reject. Those two do change what happens to mail claiming to be from your domain, and anything that sends on your behalf without being set up for it (an old booking system, a newsletter tool, your bookkeeper's invoicing) starts landing in spam or bouncing outright. Start at none. Move further only once you know everything that sends as you.

How to tell it worked. Nothing to switch on in 1pm, and no setting to change. The next reply you email in will name a time it sends at, instead of saying it waits for you. If it still waits, give DNS a few hours and try again, and check the record has not been doubled up: some hosts append your domain to the name you type, turning _dmarc.yourdomain.com into _dmarc.yourdomain.com.yourdomain.com. That is the same trap as the sending-domain records, and if you have already added those, this is the same DNS host.

In the app

Open the lead and the held reply is there in the thread, in the position it will occupy once sent, with a clock icon and one of two lines under it:

"Replied by email. Sends at 3:42pm unless you cancel."
"Replied by email, but we couldn't confirm it came from your domain. It won't send until you send it."

Beside them are Send now and Cancel.

Send now releases it immediately. Cancel stops it for good and the client never sees it. There is no countdown ticking, deliberately: hours are a clock time rather than a stopwatch, and a ticking number would suggest an urgency this does not have. Take the time to read it.

The lead also stays on Awaiting reply for as long as a held reply is not going to send itself. That is on purpose. A reply that may never leave should not clear the flag telling you the client is still waiting, or the lead quietly drops off the one list you actually scan.

What has not changed

The client sees your venue. A relayed reply goes out from your sending address with your name on it, exactly like one typed in the app. Your personal email address is never shown.
It continues the thread. The subject is the conversation's own, so it lands in the thread the client already has.
Attachments come along. Files you attached in your mail app are carried through and saved on the thread.
It threads back. The client's answer returns to the lead the same way it always did.
Only recognised addresses are relayed. Reply from an address 1pm does not know as yours and it is not relayed at all. Reply from your 1pm login, a collaborator's login, or the inbox the notification was sent to. The full detail is in how lead reply emails work.

When something stops it

A file could not be attached. The whole reply fails rather than reaching the client with the attachment missing. You get an email saying which file, and the thread shows the failure. An email that visibly did not send gets fixed. One that arrived incomplete does not.
The reply had no content. A blank message with no files is recorded as failed instead of sending your client an empty email.
It sent while you were looking at it. If a held reply reached its time while you were reading the notice, the page tells you it has already gone. Nothing is sent twice, whichever route it went by.

If one arrives that you did not write

Cancel it, from the email or from the thread. Nothing reaches your client.

Then have a think about the address it was accepted from, which the notice names. If it is your own, the likeliest explanation is a colleague replying from a shared inbox. If it is not one you recognise, somebody has guessed at an address on your account and written it into a From line, which is worth knowing about even though the hold stopped it. The email activity log records the attempt either way.

How lead reply emails work covers the sending address, the private reply address, and which inboxes may reply on your behalf.
Replying to leads covers replying in the app, templates, attachments and the fifteen second undo.
Working the leads inbox covers Awaiting reply and the rest of the pipeline.
Verifying your sending domain covers sending from your own domain, which is a different setup from the check described here.
Checking what emails went out covers the activity log every send is recorded in.