External Sender Rule
Purpose
This document establishes rules when using an email service provider that is not managed by the Office of Information Technology.
Scope
This rule applies to any WMU entity that uses an external sender to send messages on behalf of the university and sends the messages "From:" a "@wmich.edu" address.
Rule statements
- Email is authored from a WMU entity (department/program/service/etc.).
- Email鈥檚 "From:" uses an "@wmich.edu" domain address.
- External sender must be able to provide a DKIM signed key for "@wmich.edu" domain sent emails.
Definitions
DKIM (Domain Keys Identified Mail) is an email authentication technique that allows the receiver to check that an email was indeed sent and authorized by the owner of that domain.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication, policy, and reporting protocol that operates alongside Sender Policy Framework (SPF) and DomainKeys identified mail (DKIM) to determine the authenticity of an email message.
Domain (or "domain name") - In this context, it is the name of the part of the email address that鈥檚 to the right of the "@" sign as seen in email client's From: field. For example, "wmich.edu" is WMU's domain name.
External Sender, a.k.a. "external sending service" or "3rd party sender", is a service provider of email sending services that aren't managed by the Office of Information Technology.
External Sender Notification is WMU's process of adding a notification into emails to notify recipients that the email is not authored by a WMU entity and to consider the validity of the message, links, and attachments they contain.
"From:" is an email header field that specifies the author(s) of the message, that is, the mailbox(es) of the entity responsible for the writing of the message. Commonly known as "body from address".
WMU email address is the official email address assigned at the time one's Bronco NetID is created.
Justification
Security and message deliverability reliability are critical functions for the university. This rule helps provide improved security and email message deliverability through compliance with industry-standard email messaging technologies of DKIM and DMARC.
Results of Non-Compliance
Emails received to wmich.edu accounts from external senders not sent as a wmich.edu account will have WMU鈥檚 External Sender Notification included in the email message.
Enforcement
Individuals who conduct official business for Western 九一麻豆制片厂 University shall abide by the rules of this policy. Any person found to be in violation of this rule will be subject to appropriate disciplinary action as defined by current University policy.
Exceptions
Exceptions to this rule may be expressly granted by the WMU Legal Counsel, in consultation with OIT, through approved service requests and implementation processes.
Reference
Document action
Initial creation: April 18, 2022