Allow Arlo to send emails

SPF is an extension to internet e-mail. It prevents unauthorized people from forging your e-mail address.

Not all domain administrators choose to configure SPF records. If your domain doesn't use SPF records, there's nothing more that needs to be configured. As a best practice, Arlo does recommend that domain admins consider creating an SPF record. This decision and configuration change should be planned though, as creating a record without proper testing might disrupt mail delivery for other email systems in your organisation.

Arlo sends out emails when individuals place orders, register for courses, etc. The emails that Arlo sends out will often have a From address of something like training@mycompany.co.nz where mycompany.co.nz is your domain, and our systems need to be authorised to send messages on your behalf.

When processing mail and looking for spam, servers will look for SPF records on mycompany.co.nz when trying to determine whether incoming mail is being sent by an authorised server. SPF records represent a list of authorized systems that your domain administrator has configured.

If the server receiving the mail cannot find an SPF record that authorizes Arlo's servers to send mail, the messages that we send may be marked as spam. The specific action taken when a message fails an SPF check depends on how the mail administrator has configured their server. Some may drop the message, some may record the SPF check fail, but still allow it to be delivered.

So that your registrants/customers receive all course communications, it is important any existing SPF record on your domain is changed to specifically include the Arlo mail system references.

• Confirm your company email address domain e.g. michael@mycompany.co.nz.  In this case mycompany.co.nz is the domain name to check in the SPF tool.

• Navigate to https://mxtoolbox.com/spf.aspx. On this page, enter the domain name to be checked in the Domain name field and click SPF Record Lookup.

• On the results screen, check to see if your domain has an existing record.

Example: Output if you have no records.

Example: Output if you have existing records (will look something like the text below).

• If you have an existing record, you need to update it by following the rest of this process. If you do not have any existing SPF record, you don't need to do anything further.

The existing record needs to be changed to include the clause:

     include:_spf.arlo.co  (underscore inclusive)

A full SPF Record with this addition might look like this:

     v=spf1 mx include:cmail.com ip4:202.49.115.198 include:_spf.arlo.co -all

The include clause must be added before the "all" clause at the end. Note: it doesn't matter where in the record it is added, as long as it isn't after the "all".

• Navigate to https://mxtoolbox.com/spf.aspx and check your domain again.

• Check there are no warnings given for your record. The test results should have green ticks as illustrated below.

• DNS changes take time to propagate. Once the record is updated on a live DNS server, it may take 1-24 hours for the change to affect your email delivery. The exact time depends on the TTL setting for your SPF DNS record. If you are updating your SPF records because you are having problems with email delivery, please give the records time to take effect.

DKIM helps protect email senders and recipients from spam, spoofing, and phishing by providing an encryption key and digital signature that verifies that an email message was not faked or altered.

DKIM uses a pair of keys, one private and one public, to verify messages.

A private domain key adds a digital signature to the header to all outgoing email messages.

A matching public key is added to your Domain Name System (DNS) record. Recipient's email servers look up the public key and use it to decrypt the signature in the header of the email and verify that the email is authentic and unaltered.

Many public email providers, such as Gmail, are increasingly filtering emails which do not have verifiable DKIM signatures to spam, in order to protect their users from the ever increasing amount of email scams and phishing attempts.

DKIM helps to ensure emails sent from your domain are recognised by incoming mail servers as authentic and unaltered.

If you would like to set up DKIM for your emails, the first step is to contact Arlo Support or your Customer Success Manager. You should provide the email address your emails are sent from, the name and email address of the technical staff member who will be adding the records to your DNS and, if known, your DNS host.

The Arlo Support agent will generate the CNAME records for your platform and send the details through to your technical staff member for addition to your DNS.

Once received, your technical staff member will need to add the CNAME records to your DNS.

Once added, please let Arlo Support (or your CSM) know so we can complete the setup.

Once the records have been added to your DNS, Arlo can verify the records have been added correctly and finalise the DKIM setup.