This article outlines the requirements for Clients to use Blackboard E-mail Relays including configuration requirements for e-mail to be sent from [email protected] domains

Blackboard is pleased to offer an e-mail relay service for e-mails generated by the Blackboard LMS. With default settings, no further steps are usually necessary, e-mails will be sent from [email protected]. To send e-mail using a [email protected] Customers must configure SES verification, DKIM and SPF records.

DKIM and SPF are DNS Records that authorize specific e-mail servers to send mail ‘from’ specific domains. This is necessary to prevent spam. SES verification is a technology specific to Amazon AWS.

Actions You Must Take to use [email protected] e-mail with Blackboard:

If you want to use your own e-mail address but our relays, you must implement specific requirements or e-mail will not be delivered, may be delayed, or may be delivered with a generic ‘from’ address.

For example: if you own “monument.edu” and want e-mail generated by the LMS to be originated from [email protected], you must take these steps:

SES Verification:

To use [email protected] domains with your e-mail, you must verify your domain in Amazon SES. Without this, all e-mails will be sent from [email protected].

There are two types of identities:

To verify an identity, you add DNS records (TXT, MX, or CNAME) to your domain's DNS settings, or SES sends a confirmation e-mail for e-mail address identities.

Once verified, SES can send e-mails from that identity and automatically applies DKIM signatures for authenticated delivery. Without a verified SES identity, e-mails configured to be sent from custom domains will be sent from ‘[email protected]’ instead

For detailed setup instructions, see: https://docs.aws.amazon.com/ses/latest/dg/verify-domains.html

Configuring DKIM:

DomainKeys Identified Mail (DKIM) is an e-mail authentication method that uses cryptographic signatures to verify the authenticity and integrity of an e-mail message. It allows the recipient to confirm that the e-mail was sent by an authorized sender and that the content hasn't been altered during transmission.

DKIM works by adding a digital signature to the e-mail headers. The sending server signs the message with a private key, and the recipient's server uses the public key (published in DNS) to verify the signature. This prevents tampering and ensures the e-mail originated from a trusted source.

Step 1: Request DKIM setup from Blackboard Support team.

Step 2: Blackboard staff will provide instructions to create DNS CNAME records containing the required keys and tokens, like those shown in the table below.

Step 3: You must add these entries as CNAME records to your DNS hosted zone. It cannot be any other record type. Keep these records for as long as you use Blackboard’s e-mail relays.

Step 4: Once you have updated your DNS configuration, Amazon SES will automatically complete the verification process.

Configuring SPF:

SPF works by domains publishing "reverse MX" records to tell the world what machines send mail from the domain. When receiving a message from a domain, the recipient can check those records to make sure mail is coming from where it should be coming from.

For specific steps, please consult your DNS service's support or help documentation.

The entry that needs to be added is 'include:mh.blackboard.com'

If this were the only thing in the SPF record, the record would look like:

"v=spf1 include:mh.blackboard.com ~all"

But: It is expected that there will be additional entries for all verified senders, including IP's for the institution's internal relays, domains, or third party vendors. For example, if your institution uses Barracuda, then an appropriate SPF record may look like:

"v=spf1 mx/24 a:barracuda.monument.edu include:mh.blackboard.com ~all"
Keep these records for as long as you use Blackboard’s e-mail relays.

An AWS SES Identity is a verified domain or e-mail address that you authorize to send e-mails through Amazon SES. SES requires identity verification to prevent abuse and ensure high deliverability. Unlike DKIM and SPF, this is an AWS-specific technology.

How do I view my current SPF record?

Popular Internet search engines will find a number of sites that will do this for you by simply entering a URL in a search box. However, this can also be done from command line:

1. Open the Command Line Terminal (cmd.exe)
2. Type: nslookup -type=txt mydomain.com
3. Review the line starting with "v=spf

Example:

C:\>nslookup -type=txt blackboard.com 2>&1 | findstr "spf1"
"v=spf1 include:_netblocks.blackboard.com include:mh.blackboard.com include:spf.blackboardconnect.com include:_spfinc1.service-now.com include:spf.protection.outlook.com include:_spf.bbnotify.net include:servers.mcsv.net -all"

1. Open the command prompt
2. type dig txt +short mydomain.com
3. Review the line starting with "v=spf

Example:

$ dig txt +short blackboard.com | grep 'spf1'
"v=spf1 include:_netblocks.blackboard.com include:mh.blackboard.com include:spf.blackboardconnect.com include:_spfinc1.service-now.com include:spf.protection.outlook.com include:_spf.bbnotify.net include:servers.mcsv.net -all"

Blackboard enforces a maximum message size of 25 MB (26,214,400 bytes) to ensure compatibility and optimal performance. E-mails exceeding this will be rejected by the e-mail service and will not be sent. This includes all attachments. Binary attachments are typically inflated about 25% by base64 encoding.

This is independent of the domain name used in the “from” header of the e-mail.

These figures are set uniformly and cannot be varied. In practice e-mails larger than about 25 megabytes may not be deliverable anyway. Blackboard cannot control the behaviour of receiving MTAs and MTAs are permitted by Internet standards to impose a limit on the size of inbound messages to their preference.

Blackboard’s relays send e-mail using SES with TLS version 1.2 or higher. All receiving e-mail gateways and MTAs must accept TLS 1.2. This is independent of the domain name used in the “from” header of the e-mail.

The actual IP addresses used are under the control of AWS. Previously, this article recommended exempting specific IP-addresses in e-mail filters, also known as ‘whitelisting.’ Because of technology changes, that is obsolete. Existing whitelists created as prescribed by the previous version of this article can be removed.

Troubleshooting Problems:

This section applies to all e-mail deliverability issues while using Blackboard's mail relays such as