DomainKeys Identified Mail (opens new window) (DKIM) and Sender Policy Framework (opens new window) (SPF) are two ways to strengthen email security that can be implemented for the services you host with us.
Domain-based Message Authentication, Reporting and Conformance (opens new window) (DMARC) utilises both DKIM and SPF to confirm the senders identity and inform recipient servers what to do if the message fails the checks.
Sites Using AWS SES
Site hosted by us will use Amazon SES for sending mail and will by default use DKIM and SPF.
As part of the SES verification process, a private key is generated and stored by AWS. The corresponding public key, returned as part of the process, must be added to your DNS records. Once the domain is verified AWS SES will start using the key to sign emails matching the sender domain. This DNS record must remain in place for emails to work.
To use SPF you will need to add the details of Amazon's servers to your existing SPF record.
If you wish to use your primary email domain for sender addresses, eg, @council.gov.uk then you must have a relaxed DMARC policy. Due to the way AWS sends emails, a strict DMARC policy will reject them.
We recommend using a custom mail from subdomain where the DMARC policy can be modified, such as @notifications.council.gov.uk.
Your own Mail Server
We can also configure GOSS hosted applications to relay email directly to your own mail server, either directly or via a VPN. You can then implement the desired configuration, as per the guidelines. With this approach you'll need to ensure the availability of your own mail server, as not all messages from the application hosted with us will retry in the event of a failure.
Several GOSS clients are already using this method with Office 365 mail servers, where the IP address of the GOSS hosted services has been whitelisted to relay mail. We suggest speaking to your own network teams for further advice and support on this.
