SPF (Sender Policy Framework)

By adding the necessary SPF record to your DNS, the receiving mailserver can verify that Workplace Management is allowed to send emails on behalf of your domain. The following inclusion needs to be done on your DNS:

include:_spf.axxerion.com

If you would like to have more information in regards to SPF, please refer to the documentation that can be found online like this post from DMARCIAN.

Testing the spf record

If you want to test if you added the spf record correctly, you can use free online tool to see if the spf record is available. Easy to use tools are:

• https://www.dmarcanalyzer.com/nl/spf-2/checker/

• https://mxtoolbox.com/SuperTool.aspx

DKIM (Domain Keys Identified Mail)

A second method, which can be used in conjunction with the previous, is DKIM. With DKIM, a key is generated within Workplace Management, which is in turn added to the DNS. For more in depth information about DKIM, please refer to the documentation that can be found online like this post from DMARCIAN.

Generating the key

1. Within Workplace Management, navigate to the Setup through the menu on the left or the ‘Setup’ tile on the dashboard.

2. Navigate to the tab “Email” and press on the icon for “Signing domains”
   

   

3. Click on “new”

4. Fill in the following fields:
   - Domain name: the domain name for which the key applies (e.g. http://client.com )
   - Active: if the DKIM record is active
   - DKIM selector: This is used by the receiving agent or client to retrieve the public key from the DKIM DNS text record, which has the name: <selector>._domainkey.<domainmame>
   It is possible to configure multiple domains using the same specific selector for the DKIM record.
   E.g. fill in ‘spacewell’ or ‘workplace-management’ so you can easily recognize that the DNS text record that you might request

5. Click on the top right icon with the key to generate a private and public key

6. If the private key was externally generated and is encrypted, fill in the password for this private key.
   

   

7. Copy the PUBLIC key and share this with your IT department as they need to add this to their DNS. Make sure the DKIM setting is active once the record has been added to the DNS.

8. Send a test email from Axxerion and validate that is signed correctly

Background information on the non-editable fields

• HashingAlgorithm: The hashing algorithm used for the DKIM signature. Currently only SHA-256 is allowed.

• PublicKey: The public key is extracted from the private key and is not editable.

• PrivateKey: The private key must be in PEM format. For DKIM the private key must be a RSA key. Note that a new key pair can be generated with the page function 'Generate key pair'. It is also possible to enter a private key from an external source. Note that the private key is always stored in an encrypted format by a newly generated strong password.

• Length: The length of the private key is the number of bits of the 'modulus' of the private key. Currently only value2048 is allowed.

DKIM troubleshooting

1. Determine the sender domain name, for example "client.com"

2. Check that the domain of mail headers "From:" and "Mail from:" is present in the Email Signing domains and that it is active (see chapter Configure DKIM mail signing above).

3. Make sure the DNS TXT record of the email signing domain is present in the DNS of the sending domain. You can use the following website to vailidate the DNS entry: DKIM Core

4. Send a mail from the axxerion client layer to you own mail account:

   1. Contact -> Mailings -> Create new mailing

   2. Add sender contact. The email of the sender contact must match one of the signing domains defined in this client layer, for example: testdkim@somedomain.com

   3. Add one or more recipient contacts, this can be you own email address.

   4. Click "Send message"l, note that it can take some time before the mail goes to status "sent". Use refresh to show the latest status.

   5. Check if the mail is received in the mailbox.

   6. Open the email message source and make sure the DKIM-Signature header is present, for example:

      DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; t=1467293263;
      	s=selector1; d=dkimtest.axxerion.com;
      	h=From:To:Message-ID:Subject:MIME-Version:Content-Type:Date;
      	bh=wgyYNgRSqIvawIOIl/ZZ4lB8xSDZ067gS0biO571JF4=;
      	b=JLQRTJEQi6LcMRb8fBGPGjbh/j6GjL6vB+2BiHWXU9JIFjC6KgvuZwGXvCRMKb6V
      	Rd/Qc6NHIBZ+Km24oyhAc02Tqs6f+zThfI9B3IEEt466TAIhg1OjrXNDtosUhivPul/
      	UntOyB6OZO0qVyywfKCwY7dMFTB1YltnGKTTXufut2p0StslDks/SOfGV4yBXsWf07N
      	Mj4R480+2iBcYDISNumz4jiz5b2poU8Z0hpSSlMRDKzXzHzyig4ODcJ4yx2R75oJ2Vd
      	ztTQ0voxEi7utmgFOeirP0XY9KEr9Y/NQG7GwfTtIFgCZUzHw/eOo2RtsKZchifx4HT
      	x5j5v1HonA==
      

5. You can use the mail client 'thunderbird' with the 'DKIM Verifier' extention to validate the DKIM-Signature:

   1. Download thunderbird from here

   2. Configure you mail account:

      1. Edit -> Account Settings -> Account Actions -> Add mail account

      2. Fill in the pop3/imap server and you userid/password.

   3. Install the DKIM Validator add-on:

      1. Tools -> Add-ons -> Get Add-ons

      2. Search for 'DKIM' -> install

      3. You can configure the 'DKIM Verifier' in Tools -> Add-ons -> Extensions -> DKIM Verifier -> Preferences

         1. To enable debugging: Advanced -> enable debugging and Show detailed errors

   4. Open the mail with the DKIM Signature

   5. Open the error console with: <ctrl> + <shift> + j Detailed info and error messages are now shown.

Own mailserver

If the above options are not sufficient or you would like to use your own mailserver, that is also possible. Navigate to “Setup > Email”. Fill in the following fields (be aware: these values should be provided by your IT department):

Mail host: Fill in the host for the e-mail Mail port: Fill in the required port User name: The username with which the mailserver should be accessed Mail password: The username with which the mailserver should be accessed Use SSL Connection: If you would like to use the SSL variant of the connection to the mailbox TLS Mode: Select the TLS mode that you would like to use (leave it on “Default” if unknown)

Limitation

When using your own mailbox, there is one major limitation compared to using the native mail feature in Workplace Management. When Workplace Management sends an e-mail to the client server and it fails, it will not retry this e-mail. The simple reason is that if the system would do this, it might be blocked due to a possible identification as a DDoS attack (“spamming” the server with requests). In case the native e-mail feature is used, an e-mail is retried for 24 hours before failing.

Testing settings

If you want to test if the above settings apply to your e-mail, you can already test those using the methods mentioned in the articles. But one specific way which has proven to work good is the use of mail-test.com. Here you get an e-mail address where you can send an e-mail to, and it checks the spam rating of the e-mail. So enter this e-mail in any location in Workplace Management and make sure an e-mail is sent to that contact. Once it has, press on “check your score” and you have a list of possible problems and solutions on what you can change. Be aware: this is an external tool, so make sure to not send sensitive information in the test e-mail. Also, the tool is used mostly for newsletters, which means that it checks some aspects of the e-mail which are not relevant for application e-mails from a system like Workplace Management.