Managing Domain Settings

SECURITY  Security level with Admin permission to configure Email Notifications & Surveys. Refer to Admin security settings.

SECURITY  Permission to edit your company's DNS entry

NAVIGATION   > Admin > Automation > Email Notifications & Surveys > Domain Settings

Only allowing the sending of emails and notifications from verified domains will enhance the overall security of the Autotask application. Spoofing of From: email addresses associated with outgoing emails will now be prevented.

The following Autotask email addresses are impacted:

• The Support Email Address. Refer to Configuring a support email address default.
• The Primary Email Address associated with Autotask user accounts. This email address can be used as the From: email address on a number of different pages and is usually listed as Send from Resource Email. Refer to Email Addresses.
• Alternate Send From Email Addresses (up to 5 per organization). Refer to Alternate Send From Email Addresses.

In addition to these widely available Send from email addresses, users can manually enter email addresses on notification templates, workflow rules, surveys, invoice emails, and contact groups. Prior to this security update, email addresses associated with an unverified domain could be entered. Going forward, any email addresses without a verified domain can no longer be used as the Send from email address.

The Domain Settings list contains the following columns:

The Domain Settings list menu contains the following options:

IMPORTANT  The following is a general description of the formatting of a valid domain. It is not the same as a validated domain in Autotask. For that, refer to Validating and authenticating domains.

Domains are found based on the various email addresses entered and used within Autotask. The domain name starts after the @ character of an email address.

EXAMPLE  johnsmith@mail.com
In this example, .com is the top-level domain; mail is the secondary level domain.

A valid domain must meet the following requirements to be available for authentication:

• The top level domain must consist of a minimum of two characters and a maximum of 6 characters (.io, .tv ). ICANN maintains a list of valid top-level domains.
• A . (period) before the top level domain
• A minimum of 1 and a maximum of 63 characters before the top level
• Use the English character set and contain only letters (a-z, A-Z), numbers (0-9) and hyphens (-), or a combination of these
• Begin with a letter or a number and end with a letter or a number, not a hyphen (-)
• Not contain a hyphen in the third and fourth positions (e.g. www.ab- -cd.com)
• Not include a space (e.g. www.ab cd.com)
• Not include an underscore (e.g www.ab_cd.com)

EXAMPLE  Examples of valid domains:
ato.io
100Man.tv
support.mymsp.
psa.datto.com
my-msp.co.uk
llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch.co.uk (Guinness Certified World's Longest Domain Name)

EXAMPLE  Examples of invalid domains:
.com (secondary domain missing)
a.c (not a valid primary domain)
joe smith.com (space in the secondary domain)
-joe.co (hyphen in the first position of the secondary domain)
msp-man-.com (hyphen in the last position of the secondary domain)

To proactively add a domain to the list, do the following:

1. To open the page, use the path(s) in the Security and navigation section above.
2. Click New. The Add a Domain dialog box will appear.
   
3. Enter the domain name. Refer to Managing Domain Settings
4. Click Add Domain. The Domain Authentication dialog window will appear.
   

NOTE  The domain name must be unique.

For next steps, refer to Validating and authenticating domains.

To validate and optionally authenticate a domain, you must enter information from the Domain Authentication dialog window into your company's DNS entry.

• Domain validation is required for all email domains that will send email from Autotask. It consists of entering two TXT records into the DNS, the SPF and the Domain Validation TXT record.
• DKIM domain authentication is optional. It adds an extra layer of security, but you are limited to 5 domains in addition to the two system domains that are already authenticated.

To validate and optionally DKIM-authenticate your domain, do the following:

1. On the Domain Settings page, select Authentication Details from the context menu or from the Add a Domain dialog box, click Add Domain. The Domain Authentication dialog for the selected domain will appear.
   
2. Open your company's DNS record.
3. From the Domain Validation section, copy the following strings and paste them into your company's DNS record:

4. Close the Domain Authentication dialog window.
5. After the entered records have had a chance to propagate (depending on the service provider, up to 48 hours), open the window again and click Authenticate Domain.
6. If the authentication failed, an error message will indicate a reason. Authentication may fail because you did not allow enough time, or because you have reached the 5-domain limit. It is also possible that the validation will succeed, but the DKIM Authentication will fail. The error message will indicate if it is a validation or a DKIM error message.
   You should wait 48 hours and then try again.
   
7. Close the dialog.

DKIM (Domain Keys Identified Mail) is an email authentication technique that allows the recipient to check that an email was indeed sent and authorized by the owner of that domain. This is done by giving the email a digital signature. This DKIM signature is a header that is added to the message and is secured with encryption.

Once the recipient determines that an email is signed with a valid DKIM signature, it’s certain that parts of the email among which the message body and attachments haven’t been modified. The validation is done on the server level, so DKIM signatures are usually not visible to end-users.

Since DKIM authentication provides a higher level of trust, implementing the DKIM standard will result in more emails getting delivered.