Quickstart

Taifa Mail is ICTA-first: your institution's first action is asking ICTA (the Kenya ICT Authority) to approve one or more domains and a mailbox count. There is no self-service domain creation or DNS verification before that approval. This guide walks you through the whole path: create an account, submit your allocation request, wait for ICTA's per-domain decision, verify DNS on an approved domain, create a mailbox, and send a test message.

Step 1: Create your account

Go to govconnect.ke and click Register. Sign up with either:

• Google or GitHub - one click, no password to manage.
• Work email and password - enter your official work email, your institution name, and a password (at least 8 characters). We email you a link to confirm the address before you continue.

Returning users sign in at govconnect.ke/login, which emails a secure sign-in link (a magic link that expires in 15 minutes). You can also choose Use password instead or sign in with Google or GitHub.

After signing in, choose Set up my organisation. Taifa Mail is free for Kenyan government institutions: there are no plans, quotas, or payment steps.

Step 2: Submit your ICTA allocation request

Every new institution goes straight into a guided request wizard. This is the request that gets your first domain(s) approved, so there is nothing to skip here: the dashboard stays locked until ICTA decides.

1. Institution details - confirm your organisation name, type, and your role.
2. Domains - list one or more proposed domains, for example health.go.ke, ntsa.go.ke, or a subdomain such as mail.health.go.ke. Each domain needs a reason (why the institution needs it) and a mailbox count (how many officer mailboxes you need on that domain). Add a row per domain if you are requesting more than one.
3. Authorization - upload the Authorizing Officer's signed authorization letter, as a PDF, 5 MB or smaller, on official institution letterhead.
4. Review & submit - check the domains, reasons, and counts, then submit.

You receive a request reference such as TFM-A-123 and the request enters Pending ICTA review.

Step 3: Wait for ICTA's decision

ICTA reviews your authorization letter and decides on each proposed domain independently - a single request can end with some domains approved and others rejected. You are notified in-app and by email when a decision is made, and you can track status from the Mailboxes page or the request thread.

• Approved - ICTA sets a mailbox allowance for that domain (it may adjust the count) and approves mail hosting on it in the same step.
• More information needed - ICTA leaves a note or a checklist item asking for a change (for example a corrected count or a clearer letter). Reply in the request thread and resubmit.
• Rejected - ICTA leaves a note explaining why. You can address it and submit a new request for that domain.

Approving at least one domain on your initial request completes the Authorizing Officer's onboarding and unlocks the dashboard. See Request domains & mailboxes from ICTA for the full request lifecycle, including the two-way thread and how to ask for more later.

Step 4: Verify DNS on your approved domain

Once ICTA approves a domain, it appears under Domains ready to verify - this is the first point you can touch DNS for it.

1. Go to Domains in the sidebar and open the approved domain.
2. Taifa Mail gives you five DNS records to add:
   • Domain Ownership - A TXT record proving the institution controls the domain
   • SPF - A TXT record authorizing Taifa Mail to send for the domain
   • DKIM - A TXT record for cryptographic email signing
   • DMARC - A TXT record for abuse reporting and policy enforcement
   • Return Path - A CNAME record for bounce handling
3. Add these records at your DNS provider (Cloudflare, Namecheap, GoDaddy, etc.). The dashboard shows you exactly what to add and where.
4. Click I've added the records - check now. DNS can take a few minutes to propagate (Cloudflare: instant-5m, others: 5-48 hours). The domain page also auto-checks in the background every 20 seconds, so it flips to verified on its own once DNS resolves.

These five records are all you need to send. To also receive mail for mailboxes, replies, the Inbox, or forwarding, add one more record: an MX record pointing at mx1.govconnect.ke. See DNS Records Explained for the details.

Step 5: Create a mailbox

Your Mailboxes page now shows "0 of N mailboxes allocated by ICTA" for the domain, where N is the count ICTA approved.

1. Go to Mailboxes in the sidebar.
2. Click New mailbox and enter the address, for example info@health.go.ke, ps@ministry.go.ke, or support@county.go.ke.
3. Assign the mailbox to an officer (you can add more officers later).

No sending happens from a domain until a mailbox is created and assigned on it. Assigned officers read their mail in webmail at mail.govconnect.ke, or connect a mail client over IMAP/POP. See IMAP & POP mailboxes for connecting one to a mail client.

Step 6: Send a test message

You can send from the dashboard, SMTP, or the REST API. For a system integration, grab an API key from Developer -> API Keys and send a test message:

curl -X POST https://govconnect.ke/v1/emails \
  -H "Authorization: Bearer tfm_k_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "from_": {
      "email": "info@health.go.ke",
      "name": "Ministry of Health"
    },
    "to": [
      { "email": "citizen@example.com" }
    ],
    "subject": "Test message from Taifa Mail",
    "html": "<p>This is a test message from an official mailbox.</p>",
    "text": "This is a test message from an official mailbox."
  }'

Prefer an SDK?

Official client libraries handle auth, retries, and JSON for you. The same send in a few languages (see SDKs for all nine):

TypeScriptPythonPHPGo

import { TaifaMail } from '@taifamail/sdk';
 
const taifamail = new TaifaMail({ apiKey: process.env.TAIFA_MAIL_API_KEY! });
await taifamail.emails.send({
  from: 'info@health.go.ke',
  to: 'citizen@example.com',
  subject: 'Test message from Taifa Mail',
  html: '<p>This is a test message from an official mailbox.</p>',
});

A successful response returns 202 Accepted with the email ID, its status, and the generated Message-ID:

{
	"id": "em_abc123def456",
	"status": "queued",
	"message_id": "<abc123def456@govconnect.ke>",
	"rejection_reason": null
}

Step 7: Check delivery

You can check delivery status in two ways:

Dashboard: open Developer → Email Logs to see a timeline of every email with its current status (queued, delivered, open, bounced, etc.).

API - fetch events for a specific email:

curl https://govconnect.ke/v1/emails/em_abc123def456/events \
  -H "Authorization: Bearer tfm_k_your_api_key_here"

[
	{
		"id": "ev_123",
		"event_type": "queued",
		"metadata": null,
		"created_at": "2026-04-06T10:30:00Z"
	},
	{
		"id": "ev_124",
		"event_type": "delivered",
		"metadata": null,
		"created_at": "2026-04-06T10:30:02Z"
	},
	{
		"id": "ev_125",
		"event_type": "open",
		"metadata": { "timestamp": "2026-04-06T10:31:15Z" },
		"created_at": "2026-04-06T10:31:15Z"
	}
]

What next?

• Request domains & mailboxes from ICTA - the full request lifecycle: multi-domain proposals, per-domain decisions, the info-request checklist, and asking for more later.
• IMAP & POP mailboxes - connect official mailboxes to mail clients.
• SMTP Guide - configure government systems to send via mail.govconnect.ke.
• API Reference - full endpoint documentation for emails, contacts, domains, and webhooks.