William James College Third-Party Email Sending and Authentication Standard – WJC Information Technology and Services Office

Responsible Office: Information Technology
Applies To: All College departments, faculty, staff, and authorized third-party applications

Purpose

To ensure reliable email delivery, protect the College's email domain reputation, and prevent email spoofing and phishing, all third-party applications sending email on behalf of William James College must meet the College's email security and authentication requirements.

Improperly configured applications may cause messages to be blocked, rejected, quarantined, or identified as phishing by William James College and Other 3rd Party Email Services

Scope

This standard applies to all College departments, faculty, and staff using third-party applications or services to send automated notifications, announcements, reminders, or other email communications to College users or external recipients.

Email Sending Requirements

Rule 1: Third-Party Applications Using External Sender Addresses

When a third-party application sends email to College users using its own external email address or domain:

The sending address or domain must be identified and reviewed by IT.
IT will validate the sender's email authentication configuration and determine whether an approved exception to the College's spam filtering rules is necessary.
Messages from unrecognized or improperly configured senders may be blocked or quarantined.

Rule 2: Third-Party Applications Sending as a College Email Address

When a third-party application sends email using a @williamjames.edu address, rather than its own domain:

The application and intended sender address must be reviewed and authorized by IT.
Appropriate SPF and DKIM authentication must be configured for the sending service, as applicable.
IT will verify that the configuration satisfies the College's existing DMARC requirements.
IT will determine whether additional email filtering exceptions are necessary.
Unauthorized or improperly authenticated sending may result in messages being identified as spoofing or phishing.

Rule 3: Third-Party Applications Sending Through College Email Services

When a third-party application sends email to internal or external recipients through the College's Microsoft 365 email service using an authorized College email address:

The application must be reviewed and authorized by IT.
Appropriate Microsoft 365/Entra ID authentication and sender permissions must be established.
The application must use a College-approved email sending method.
IT will verify that the application's email delivery method meets applicable SPF, DKIM, and DMARC authentication requirements. Additional DNS records are not necessarily required when sending through the College's existing authenticated email infrastructure.
Unauthorized applications or improperly configured sending methods may be blocked or classified as phishing.

4. Example Scenarios

Scenario	Applicable Rule	Requirements
Learning Management System sends notifications from training@xxx.net to College users.	Rule 1	IT reviews the external sender, validates authentication, and configures a filtering exception if necessary.
Learning Management System sends notifications displaying xxx@williamjames.edu as the sender.	Rule 2	IT authorizes the sender, validates SPF/DKIM and DMARC alignment, and reviews any necessary filtering exceptions.
Learning Management System sends email through Exchange Online using xxx@williamjames.edu.	Rule 3	IT verifies Microsoft 365 authorization, sender permissions, and applicable email authentication requirements.

5. Department Responsibilities

Before enabling or changing email sending capabilities in a third-party application, the requesting department must:

Notify the IT Office of the application and intended email usage.
Identify the email address that will appear as the sender.
Identify whether messages will be sent to College users, external recipients, or both.
Coordinate with IT to complete any necessary email authentication and security configurations.
Verify successful email delivery before beginning production use.

The requesting department remains responsible for the content, intended recipients, and appropriate use of the application's email communications.

6. IT Office Responsibilities

The IT Office is responsible for reviewing and implementing necessary email authentication, Microsoft 365 permissions, and email security configurations.

The IT Office will validate third-party providers' email authentication configurations, including applicable SPF, DKIM, and DMARC requirements, before approving an integration.

The College maintains DMARC protection for its email domain. Third-party integrations must comply with the College's established authentication requirements. SPF and DKIM should both be configured when supported; DMARC compliance requires at least one passing, aligned authentication mechanism.

IT may reject or restrict configurations that introduce unacceptable email security risks or compromise the College's domain reputation.

7. Compliance

All third-party email sending configurations must be reviewed by IT before production use.

Departments must coordinate with IT before enabling new applications, changing sender addresses, or modifying existing email delivery configurations.

Applications that do not meet the College's email authentication and security requirements may be restricted or blocked until the necessary configurations have been completed and validated.