Website Email with Cloud Mail: DNS and Permissions
A tidy guide to set up your website's outgoing email with your corporate cloud mail platform: DNS and least-privilege permissions. Ask IT Lab for support.
Contact forms, order confirmations and notices from a website depend on email going out and arriving properly. Setting it up in an orderly way, using the corporate cloud email platform, improves delivery and reduces security risks.
- The site should send email through an authorised channel, not through improvised settings.
- DNS records state which services may send email on behalf of the domain.
- Application permissions should be the minimum necessary.
Why it matters
A site that sends email without formal authorisation may see its messages land in spam or be rejected, and a poorly configured domain is easier to impersonate. Concentrating sending on the corporate platform also keeps control and traceability in one place.
The components, simply
- Domain DNS. The "address book" stating where the site is and which email services are authorised for the domain.
- Email authentication records. Mechanisms published in DNS that help recipients verify a message is legitimate.
- Application registration in the email platform. The site registers as an application with its own identity.
- Minimum permissions. Only the ability to send email is granted, not access to mailboxes or other data.
- Administrator consent. An organisation administrator approves those permissions explicitly.
A prudent order of work
- Define who administers DNS and who administers the email platform.
- Document the current state before changing anything.
- Make DNS changes with a step-by-step guide and a rollback plan.
- Test sending and check that messages arrive and authenticate.
- Record the change in change control.
Specific values depend on each domain and are not published in this article.
What to do
- Review today how your website sends email and with which account.
- Avoid personal or broadly privileged accounts for this purpose.
- Protect the DNS administration account with multi-factor authentication.
- Document who may change DNS.
- Include DNS and email in your continuity plan.
Frequently asked questions
Why do my website emails land in spam? A frequent cause is missing domain authentication or sending from an unauthorised channel.
Who should make DNS changes? Whoever administers the domain, with a backup of the previous state and an agreed change window.
Is it safe to grant permissions to an application? It is if permissions are minimal, approved by an administrator and reviewed periodically.
When supporting our clients, we provide step-by-step guides so their team can point domains and set up the site's email sending with their corporate platform. On change control, see Immutable infrastructure.
IT Lab supports Chilean organisations in this. Contact us.
Do you need someone to take care of your technology?
Tell us what you need to organize, protect or solve. The first conversation has no cost: we assess whether our model fits you and what the next steps would be.
Let's talk about your business