Setting up Sending domains for Showpad

More and more, organizations are implementing stringent security protocols to protect confidential data. In many cases, shares should come from a domain that is specific to the person sending the message instead of the default share@showpad.com address. If buyers reply to the sharing email, you want it to be redirected to the user's company email address.

In Showpad’s Online Platform, you can set this up using 

• Default Domains
• A Custom Global Sending Domain

When using Default Domains, cooperate with your IT department if terms like DMARC, CNAME, DNS, SPF, DKIM, and MX settings sound unfamiliar. This requires changes to the existing email domain settings.

A Custom Sending Domain is used when IT security settings prevent an organization from setting up shares to send from users' email addresses because it requires changing the company's DNS settings. In these cases, Showpad allows you to manually set up a Custom Sending Domain and validate it for external sharing purposes.

This article describes how you can set up Default Domains and a Custom Sending Domain for your organization.

Note: Cooperate with your IT department to add the sending domain configurations to your settings.

Key features

• Let users send out share emails using their company email address
• Make share emails for prospects more personal
• Share emails are less classified as spam
• Allow a Custom Sending Domain

You need this to succeed

• Available on all Showpad plans
• Showpad Admin access
• A domain that will be shown as the sender for shares

The quick way to awesomeness

• Validate your domain to avoid abuse.
• Validation requires setting up DNS records, which depend on the chosen verification method. These records can be TXT, MX, SPF, DKIM, or TXT, CNAME records. A DMARC record is also required.
• In the Custom Global Sending Domain section, set up a configuration for a custom domain
• Add the domains manually and validate, just like regular domain validation
• These custom domains can be used as a replacement for the existing email addresses domain, and the reply-to address will always be the user’s real email address

Do this step by step

• Selecting your sending domain Settings
• Using a Custom Global Sending Domain
• Using Default Domain details
• Ensuring a DMARC record is set
• Most common issues

Settings

Go to the Online Platform, Admin Settings, and Sending Domains.

Here, you can choose between sending from the Showpad domain or your users' company email addresses.

If you select Always use Showpad, all emails are sent via the default Showpad share@showpad.com address.

If you select Use a custom or verified default domain, only users who have sending domains configured can send emails from their own addresses. The other users will use share@showpad.com, or, if configured, a Custom Sending Domain email address.

Custom Global Sending Domain

1. Click Add Configuration under Custom Global Sending Domain.
2. Enter the domain that you want shares to be sent from. You must verify the settings with SPF/DKIM or CNAME records.
3. Once the configuration has been set on the mail server, click Verify Now.
4. When the verification status button is green, the custom sending domain will be used. Otherwise, it will default to sending from share@showpad.com. When there are errors, hover over the error for further details.

Note: If you have multiple Showpad organizations authorized in your DNS records to use the same Sending Domain, the configuration and verification status will be propagated in all the authorized organizations.

Using Default Domain details

1. To set up Default Domains, locate the configuration settings in Showpad's Online Platform. These details are necessary for your IT department to configure the sending domains, which requires changing the company's DNS settings.
2. You will likely already see a list of sending domains you can configure. The domains you see here are automatically added based on the email addresses of the users you added to the Online Platform.
   For example, when you create a user with test.user@myorganization.com as an email address, myorganization.com will automatically be added to this list as a domain name. The domains in the screenshot were added as an example.
   Click the Configuration button to see the current keys and values.
3. Select a Configuration Type:

• SPF/DKIM (manual security)
  In this configuration type, we generate DKIM, SPF, MX, and DMARC records for you, which you need to add to your domain's DNS. This type supports a maximum DKIM record length of 1024 bits.

  View SPF/DKIM configuration keys and values:

  • TXT is an extra mandatory permission record for verification. The TXT record is unique for each Showpad instance and ensures that no other Showpad instance can be sent from your domain. Checking if the TXT Value is added to your company's DNS records is the first step in the verification process. It is the authorization needed to verify a Sending Domain in your organization.
  • DKIM is a signing key for the message which proves that content was not altered by any server along the way.
  • SPF and SenderID allow a domain owner to add a file or record on the server that the recipient server cross-checks. This Sender Policy Framework (SPF) is an email validation protocol to detect and block email spoofing. It verifies that incoming mail from a domain comes from an IP Address authorized by the domain administrator.
  • DMARC (Domain-based Message Authentication, Reporting, and Conformance) is essential for email security. It helps prevent email spoofing and ensures that only legitimate emails are sent from your domain.

    Note: Adding the MX record is strongly encouraged to prevent internal sharing problems and is extra security against being marked as spam.

    

• CNAME (automatic security)
  In this configuration type, we generate several CNAME and DMARC records for you, which you need to add to your domain's DNS. In this case, you will link to the DKIM and SPF records we automatically prepare for you.
  The CNAME configuration type provides timely rotation of DKIM keys, increasing security, and supports a maximum DKIM record length of 2048 bits. If you have used this type for a long time and your DKIM key is short, you can use another selector and we will generate a new key of maximum length.

  View CNAME configuration keys and values:

  • TXT is an extra mandatory permission record for verification. The TXT record is unique for each Showpad instance and ensures that no other Showpad instance can be sent from your domain. Checking if the TXT Value is added to your company's DNS records is the first step in the verification process. It is the authorization needed to verify a Sending Domain in your organization.
  • CNAME (Canonical Name) record is used in DNS to alias one domain name to another. In our case, we use it to create links to automatically generated records.
  • DMARC (Domain-based Message Authentication, Reporting, and Conformance) is essential for email security. It helps prevent email spoofing and ensures that only legitimate emails are sent from your domain.

Verification for SPF, DKIM, and MX (for SPF configuration) or CNAMEs (for CNAME configuration) is necessary to make sending domains work.

4. Select the Verify Now button to verify your domain.
5. Provide these details to your IT team and let them implement the changes on your company's domain settings. You can download a Zone file that contains the configuration in a single file.

Note: Depending on the domain configuration, it can take up to 24 hours before DNS changes are visible.

Ensure a DMARC policy is set

As of February 1st, 2024, for mail to be delivered as expected, a DMARC policy must be set for each domain that sends mail. A DMARC (Domain-based Message Authentication, Reporting & Conformance) policy allows a sender to indicate that their messages are protected by DKIM and/or SPF, or CNAME, and tells a receiver what to do if neither of those authentication methods passes.

Validate your domain here https://domain-checker.valimail.com/dmarc/ by entering

showpad.your-domain.com

If your domain does not have a DMARC record in place, contact your IT team.

Your IT team needs to publish a valid DMARC policy with at least p=none - DMARC must pass

• Including a “rua” tag, which is properly set up to receive reports, is strongly recommended to allow monitoring during initial setup
• Relaxed alignment is acceptable
• Ensure the domain in the From: header is aligned with either the SPF domain or the DKIM domain. This is required for DMARC alignment.

Example

_dmarc.your-domain.com TXT "v=DMARC1; p=none; rua=mailto:recipient_to_receive_reports@your-domain.com"

Most common issues

We provide this helpful checklist in case the indicators are red.

• Confirm with your IT team that the sending domains have been configured on the company's domain side.
• Depending on your domain registrar, adding your own domain to the DNS records is not necessary, as this doesn't create valid records for the sending domains to work.
  • Sometimes, copying the value will automatically add your own domain to the DNS record, which will cause a double-paste of the domain, as seen in this example:
    •  input: "showpad-verification.example.com"
      result: "showpad-verification.example.com.example.com"
    • If you notice a double domain, simply delete the extra, and the DNS setting will work properly.
• The changes to the DNS settings can take up to 24 hours to fully populate. That's the maximum time needed for all servers to know the changed records. We advise you to wait and try to verify the settings again the next day.
• Ensure you have not forgotten to add Showpad to the keys of your settings. For example, it can happen that the configuration was set in place for myorganization.com instead of showpad.myorganization.com
• Make sure there are no extra spaces or missing letters in the settings. We advise copy-pasting keys and values to make sure everything is correct.
• DMARC should be set to Relaxed. If the DKIM and SPF records are correct, the DMARC can also be set to Reject. 
• In cases where SPF/DKIM or the m1 selector cannot be used, you can choose a custom selector. This only works for the CNAME configuration type. If you type sp1 into the Selector field, for example, the key/value pairs should update and show new CNAME records.