docs(cloud): worked SMTP examples per provider, and re-verify the mail-server guide against v1.0.253

AGENTS.md

@@ -44,6 +44,17 @@ A literal backslash inside inline HTML is a related trap: Goldmark reads the `\<
 (`content/en/kanvas/reference/keyboard-shortcuts.md` is the worked example) and confirm the
 built HTML, not the source, before committing.
 
+## Documenting Layer5 Cloud behavior
+
+The cloud guides describe a product that lives in `meshery-cloud`, so every product claim is
+verified against `origin/master` there, never against a summary. The screen strings are in
+`ui/components/identity/org-management/`; the behavior behind them is in `server/handlers/`.
+
+That repo's own `docs/reference/` and `docs/runbooks/` are the best starting point but are not
+the arbiter - they have described behavior the handlers do not implement. Confirm a capability
+has a producer in the Go or TSX before writing it up: a contract enum member or a runbook
+sentence is not proof the feature ships.
+
 ## Maintaining this file
 
 Keep this file for knowledge useful to almost every future agent session in this project.

content/en/cloud/guides/organizations/org-management/_index.md

@@ -77,9 +77,9 @@ Switching identity providers does not affect existing user accounts or login his
 
 The **Email** tab lets your Organization send application mail such as invitations and notifications through **its own SMTP server**, from **its own domain**, instead of through Layer5's shared mail server. Nothing about the message then points to a shared provider.
 
-Setting it up has three steps, and mail keeps leaving through Layer5's shared server until all three are done: register the server and its credentials, prove control of the sending domain by publishing a DNS TXT record, and pass a connection test before turning the server on. The tab reports delivery health afterwards, and a fallback setting decides what happens to a message your server refuses.
+Setting it up has three steps: register the server and its credentials, prove control of the sending domain by publishing a DNS TXT record, and pass a connection test. Completing them changes nothing on its own - mail keeps leaving through Layer5's shared server until an administrator clicks **Turn on**, which is what switches routing over. The tab reports delivery health afterwards, and a fallback setting decides what happens to a message your server does not accept.
 
-The full walkthrough, including the Google Workspace paths and a troubleshooting table for every failure the tab reports, is in [Bring Your Own Mail Server](bring-your-own-mail-server/).
+The full walkthrough, including a worked example for Google Workspace, Microsoft 365, Amazon SES, SendGrid and Postmark, and a troubleshooting table for every failure the tab reports, is in [Bring Your Own Mail Server](bring-your-own-mail-server/).
 
 {{< alert title="Who can configure this" type="info" >}}
 Organization Administrators and Owners can configure, test, turn on, turn off, and remove their Organization's mail server, under the same gate as the Identity Providers tab.