Security guidance for senders of mass email and workflow email

• Overview
• Requirements
• Recommendations
• IU List or Salesforce?

Overview

When sending mass email messages or email as part of an automated workflow, be sure to comply with the requirements and recommendations listed here to give recipients greater confidence that your communication is legitimate.

• For more about mass email, see About IU's policy on mass email.
• For details and examples of content for workflow messages, see Guidelines for content of automatic email messages.

To view all the content available to you here, use the green Log in button at the top of this page to log into the Knowledge Base.

Requirements

Whenever technically practicable:

• If your message is automated, or sent to multiple readers through a third party (for example, Salesforce), you should configure your settings to include the IU trusted security footer.

  More details about the IU Trusted Footer are available to the IU community. To view all the content available to you here, use the green Log in button at the top of this page to log into the Knowledge Base.

• Send your message from an @iu.edu or campus address (for example, @iupui.edu, @iuk.edu, @indiana.edu)
• If your message includes URLs, link either to iu.edu or to campus domains. If you need to create links that forward to other domains, use Go.IU, e.iu.edu (trusted domain used in Salesforce messaging at IU), or link directly to the external domains.
• Official email messages should use official IU branding.

Recommendations

• If you are sending a single mailing exceeding any of the following thresholds, send advance notice to mass-mail-notify-l@iu.edu, preferably at least 24 hours in advance of the mailing:
  • 50,000 IU accounts during business hours (8am-6pm Eastern Time)
  • 1000 IU accounts in a given minute

  Include the total recipients and/or sending rate along with the subject and sending address to be used for the mailing.

  To preserve IT resources and reduce service impact to IU email delivery, you may be asked to reschedule your mass mailing if multiple mailings are planned to go out simultaneously.

  Note:

  These thresholds do not apply to email messages to external recipients (leaving the IU email systems) or Exchange-to-Exchange mailings. Contact your campus Support Center if you are unsure whether your mailing qualifies.
• If a mass mailing will direct readers to contact another unit for support or questions, you should be in communication with that unit at least one week prior to sending (two if possible) to allow them to prepare for the support impact.
• Especially for tasks that require authentication, consider instructing recipients to access the task via One.IU, rather than embedding a link. (If a link is necessary, see the requirements above.)
• If you're sending a message from a group account, include individual contact information.
• Don't include attachments unless necessary.
• Use the Bcc field if you're using Exchange to send your message, unless you're also using mail merge.
• Make sure your content matches your website content. If your message will advertise a survey or an event, recipients may want to search for it later; including that information on your website can bolster authenticity.