Security guidance for senders of mass email and workflow email

On this page:


When sending mass email messages or email as part of an automated workflow, be sure to comply with the requirements and recommendations listed here to give recipients greater confidence that your communication is legitimate.

To view all the content available to you here, use the green Log in button at the top of this page to log into the Knowledge Base.


Mail sent from IU Exchange Online mailboxes is constrained by several per-message and daily limits; see Exchange Online limits.

Whenever technically practicable:

  • If your message is automated, or sent to multiple readers through a third party (for example, Salesforce), you should configure your settings to include the IU trusted security footer.

    More details about the IU Trusted Footer are available to the IU community.

    To view all the content available to you here, use the green Log in button at the top of this page to log into the Knowledge Base.

  • Send your message from an or campus address (for example,,,
  • If your message includes URLs, link either to or to campus domains. If you need to create links that forward to other domains, use Go.IU, (trusted domain used in Salesforce messaging at IU), or link directly to the external domains.
  • Official email messages should use official IU branding.


  • If a mass mailing will direct readers to contact another unit for support or questions, you should be in communication with that unit at least one week prior to sending (two if possible) to allow them to prepare for the support impact.
  • Especially for tasks that require authentication, consider instructing recipients to access the task via One.IU, rather than embedding a link. (If a link is necessary, see the requirements above.)
  • If you're sending a message from a group account, include individual contact information.
  • Don't include attachments unless necessary.
  • Use the Bcc field if you're using Exchange to send your message, unless you're also using mail merge.
  • Make sure your content matches your website content. If your message will advertise a survey or an event, recipients may want to search for it later; including that information on your website can bolster authenticity.

IU List or Salesforce?

Any unit that needs to send mass communications to broad audiences inside or outside the university may choose to adopt Salesforce, but IU List may meet some needs better. The following are some considerations for each platform.

Features Salesforce IU List
Message tracking analytics Yes No
Defining recipients
Gives you access to specific IU audiences (for example, one department, multiple departments, or entire campuses) without setting up a specific list and subscribing addresses to it
Requires a dedicated list to be set up for each group of recipients, with all recipient email addresses subscribed
Communication type Only one-way
Multiple options for restricting or allowing email from different people
Cannot include attachments in email messages
Can include attachments
Group accounts
Cannot be included in recipient lists
May be subscribed to a list
As a guideline, IU List mailing lists should have no more than 30,000 subscribers; also, the more active the list, the lower the number of subscribers should be. To ensure mail delivery, the IU List system administrator may throttle any list that causes excessive load on the mail relays. If you need to send communications to more than 30,000 people, you may want to consider using Salesforce instead.

This is document aqjz in the Knowledge Base.
Last modified on 2023-12-19 12:50:08.