Security guidance for senders of mass email and workflow email

On this page:


When sending mass email messages or email as part of an automated workflow, be sure to comply with the requirements and recommendations listed here to give recipients greater confidence that your communication is legitimate.

To view all the content available to you here, use the green Log in button at the top of this page to log into the Knowledge Base.


Due to enhanced security features in Exchange Online, digital signatures are no longer required at IU; however, digital signatures will continue to work as expected if you wish to continue using them.


Whenever technically practicable:

  • If your message is automated, or sent to multiple readers through a third party (for example, Salesforce), you should configure your settings to include the IU trusted security footer.

    More details about the IU Trusted Footer are available to the IU community. To view all the content available to you here, use the green Log in button at the top of this page to log into the Knowledge Base.

  • Send your message from an or campus address (for example,,,
  • If your message includes URLs, link either to or to campus domains. If you need to create links that forward to other domains, use Go.IU, (trusted domain used in Salesforce messaging at IU), or link directly to the external domains.
  • Official email messages should use official IU branding.


  • If you are sending a single mailing exceeding any of the following thresholds, send advance notice to, preferably at least 24 hours in advance of the mailing:
    • 50,000 IU accounts during business hours (8am-6pm Eastern Time)
    • 1000 IU accounts in a given minute

    Include the total recipients and/or sending rate along with the subject and sending address to be used for the mailing.

    To preserve IT resources and reduce service impact to IU email delivery, you may be asked to reschedule your mass mailing if multiple mailings are planned to go out simultaneously.

    These thresholds do not apply to email messages to external recipients (leaving the IU email systems) or Exchange-to-Exchange mailings. Contact your campus Support Center if you are unsure whether your mailing qualifies.
  • If a mass mailing will direct readers to contact another unit for support or questions, you should be in communication with that unit at least one week prior to sending (two if possible) to allow them to prepare for the support impact.
  • Especially for tasks that require authentication, consider instructing recipients to access the task via One.IU, rather than embedding a link. (If a link is necessary, see the requirements above.)
  • If you're sending a message from a group account, include individual contact information.
  • Don't include attachments unless necessary.
  • Use the Bcc field if you're using Exchange to send your message, unless you're also using mail merge.
  • Make sure your content matches your website content. If your message will advertise a survey or an event, recipients may want to search for it later; including that information on your website can bolster authenticity.

IU List or Salesforce?

Any unit that needs to send mass communications to broad audiences inside or outside the university may choose to adopt Salesforce, but IU List may meet some needs better. The following are some considerations for each platform.

Features Salesforce IU List
Message tracking analytics Yes No
Defining recipients
Gives you access to specific IU audiences (for example, one department, multiple departments, or entire campuses) without setting up a specific list and subscribing addresses to it
Requires a dedicated list to be set up for each group of recipients, with all recipient email addresses subscribed
Communication type Only one-way
Multiple options for restricting or allowing email from different people
Cannot include attachments in email messages
Can include attachments
Group accounts
Cannot be included in recipient lists
May be subscribed to a list
As a guideline, IU List mailing lists should have no more than 30,000 subscribers; also, the more active the list, the lower the number of subscribers should be. To ensure mail delivery, the IU List system administrator may throttle any list that causes excessive load on the mail relays. If you need to send communications to more than 30,000 people, you may want to consider using Salesforce instead.

This is document aqjz in the Knowledge Base.
Last modified on 2022-10-12 10:54:11.