The Newsletter Your Own Office Never Receives

Everyone on the list but the office

The spring newsletter goes out on Tuesday morning. By Thursday a customer has replied about an item in it, and the office manager realises nobody in the building ever saw it.

Staff are on the list, as they have been for every issue. Their inboxes and junk folders hold nothing, so the natural conclusion is that the newsletter was never sent.

The mailing service's report says otherwise: sent to every address, and accepted by the office's own mail server. Somewhere between that server and the staff inboxes, the issue was set aside.

Mail that claims to come from home

The newsletter's From line carries the business's own address, so to the office mail server it appears to come from the office itself.

Yet it arrives from the mailing service's servers. Outside mail claiming your own domain is a classic sign of forgery, since scammers like to pose as a colleague or the boss.

Many mail servers and spam filters treat that combination harshly. Depending on the settings, the newsletter is refused, held in a quarantine nobody checks, or delivered straight to junk.

Where the newsletter may be sitting

• A quarantine on the filter, reviewed only by whoever set it up, if anyone.
• A daily digest of held mail, sent to one person who deletes it unread.
• Junk folders on each computer, emptied automatically after a few days.
• The bounce list in the mailing service's report, when the office server refused it outright.
• Nowhere at all, when a rule deletes suspected forgeries without keeping them.

The mailing service's report narrows it down. Addresses marked as bounced were turned away at the door; addresses marked delivered were accepted and then filed somewhere inside the office.

The record that lists permitted senders

Every domain can publish a short text record, called SPF, naming the servers that may send its mail. Receiving servers look it up and compare it with where each message actually came from.

If the record names only the office mail server, the newsletter fails that comparison. The fix is to add the mailing service to the record, using the exact wording the service gives in its instructions.

A domain should have only one SPF record. Adding a second one instead of editing the first makes both fail, an easy mistake when several people have touched the domain settings over the years.

A signature as well

The second record is a DKIM key. The mailing service signs each message, and the key published in your domain's settings lets a receiving server confirm the signature was made with your permission.

Most mailing services offer this under their authentication settings, with the record to copy. Until it is published, they sign with their own domain, which tells the receiving server nothing about yours.

With both in place, the newsletter carries proof of permission wherever it lands.

A published policy on top

A third record, DMARC, lets a domain tell receiving servers what to do with mail that fails these checks: deliver it anyway, put it in junk, or refuse it.

Yahoo and AOL published refusal policies this spring, which is why newsletters sent through mailing services from their addresses started bouncing. Any business can make the same choice for its domain.

Consider one only once SPF and DKIM pass for every service sending as you; published too early, a strict policy gets your own newsletter refused.

A worked example

An access control installer with twelve staff fits card readers and door entry systems in offices and apartment buildings, and sends a newsletter each season to property managers and past customers.

The office runs its own mail server and spam filter, set up years ago by an outside technician. Staff had always been on the list and could not remember receiving an issue.

The mailing service's report showed every office address as delivered. The technician found all of them in the filter's quarantine, held by a rule against outside mail claiming to come from the company's own domain.

The domain's SPF record listed only the office server. The technician added the mailing service, published its DKIM key, and changed the filter rule to let through own-domain mail that passes both checks.

The quarantine digest now goes to the office manager as well, so anything the rule still holds is seen by someone who can release it.

Filter settings to check

The domain records help with every receiving server that checks them. The office's own filter may still need attention, because rules written against forgery often ignore SPF entirely.

Look for a setting that blocks or scores own-domain mail arriving from outside. Make the exception for messages that pass SPF or DKIM, not for the From address alone.

A From address is easy to fake, so allowing everything that claims the newsletter's address would let real forgeries through with it.

Testing before the next send

Before the real send, send a test copy to two or three staff addresses and an outside address at a free email service, and check where each lands.

Open the full headers of the copy in the outside account. A line headed Authentication-Results shows whether SPF and DKIM passed, in plain words such as spf=pass.

Keep a few staff addresses on the list permanently as a check. If they stop receiving an issue, you will know within the hour, not from a customer two days later.

The counter-case

Offices whose mail is handled by a large hosted email service may never meet this problem, because those services weigh SPF and DKIM sensibly rather than blocking own-domain mail outright.

Some businesses also send newsletters from a separate subdomain set aside for bulk mail, which keeps it apart from everyday office mail and its filter rules.

But the records matter in both cases. Every customer's mail server asks the same question about permitted senders, and a newsletter that cannot answer it is treated with suspicion everywhere.

Letting the newsletter reach the office

1. Check the mailing service's report for the office addresses.
2. Search the filter's quarantine for the last issue.
3. Find the domain's SPF record and who can change it.
4. Add the mailing service to that single record.
5. Publish the DKIM key the service provides.
6. Adjust the filter rule for authenticated own-domain mail.
7. Send a test to staff and an outside address.

Step three often takes longest, because the records may sit with the registrar, the host or a technician who has moved on. Find out who can change them before anything is urgent.

The website is often another sender the record leaves out, and fixing the messages it sends is covered in emails from the website signed WordPress.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.