Notifications from Bb going to recipient's spam

Phil Paskvan

In EM we have notifications set up to go to selected constituents when certain actions are completed. Examples: When we add a new student upon saving a notification goes out to staff. Upon contract completion a notification goes out to the family telling them its status etc.

These emails are going to peope spam boxes or getting blocked completely.

I looked into the email logs of these notifications received in my spam folder in Google admin and I can trace them. The spambox shows the notification coming from “mvcds@myschoolapp.com”, (mvcds being our instance/school) including a harmful email warning . The report shows that the notification is actually coming from “bounce@blackbaudemail.netcommunity1.com”

When running this bounce@blackbaudemail.netcommunity1.com against mxtoolbox I get reports of DMARC errors. This suggests the server Bb uses to send the notifications has issues and now that Yahoo and Google are enforcing DMARC, DKIM and SPF the recipient's are blocking or sending to spam. Anyone else seeing similar? To make it more confusing, pushpages in the Google domain show the same bounce@blackbaudemail.netcommunity1.com as the sender and they seem to be getting delivered.

Jeff Gaudet

@Phil Paskvan Have you updated your DMARC, SPF, and DKIM in your DNS? This alignment process went into effect with Google on Feb 1, 2024. There are a few steps that need to be done. The first is the DMARC and DKIM public keys that need to be added to your DNS. Google was very quick with the information needed. I say Google because that is who our ESP is. If you use someone else you will need to contact them for the updated keys. Once you have those add them to your DNS. The second part is acquiring the public keys from Blackbaud since this is how your communications through BB are sent out and you need this specific key to show that your outgoing mail through BB is safe. Finally, there is a TXT tag that needs to be added as well from BB to update your SPF if you use programs like Raisers Edge. It will look something like this: +include:outboundmail.blackbaud.net ~all

For more information refer to the following Guides:

https://docs.blackbaud.com/email-resource-center/faqs/best-practices-faq#what-is-dkim-and-how-do-i-add-it and https://docs.blackbaud.com/email-resource-center/overview/client/sender-authentication/dkim

Hope this helps. Jeff

Phil Paskvan

@Jeff Gaudet
We've already completed all those steps, prior to the Feb. 1st deadline. Our domain is set. When examining the headers of these emails there is no mention of our domain at all. They 100% come from Bb servers

Jeff Gaudet

@Phil Paskvan Since you are using Netcommunity, have you added the SPF Text record to your DNS that was mentioned earlier? If so, could you post a report from dmarcian.com of one of your XML reports? I'd like to see what is showing as rejected and failed.

Phil Paskvan

@Jeff Gaudet
bounce@blackbaudemail.netcommunity1.com

gets flagged on this report too

Will Chambers

@Jeff Gaudet Thanks for all your input. All of our records are set, and pass all checks. The only “issue” we have right now is I have our DMARC action set to “none” - until we get through these issues, then I'll change the action to quarantine or reject - probably the latter.

Anyhow, I was using Valimail for our DMARC reports, so I made a change to our records so Phil and I will receive the agg and forensic report emails. I'll then use the tool you suggested to see what the failure is.

FWIW, the emails being flagged as SPAM that I'm seeing in our log search tool in the google admin are showing that these emails are passing SPF, DKIM, etc. - however google is stating they're being moved to spam due to the following.

Spam classification details:

The message was considered phishing.

The message contains suspicious content.

While I can make exemptions in our email filters, the problem is I can't do that for parent's emails, etc. that are outside of our domain.

Also, as @Phil Paskvan already showed, BB seems to have some issues on their end from what we're gathering from tools like mxtoolbox. In the end, these emails are never being sent on behalf of our domain, so I'm not quite understanding why our DNS records matter. The email are coming form @myschoolapp.com - which is a BB owned domain.

Phil Paskvan

@Will Chambers

From Support:

"Good Afternoon. I am following up regarding system notifications being marked as SPAM by Google. Google has increased their flagging of SPAM recently. The notifications sent from the myschoolapp domain use on set of DMARC, DKIM, and SPF settings since every school's notifications come from the same domain. I have worked with internal resources to check and confirm that these are correctly set up.

In order to limit Google's flagging as SPAM there are directions you can take with settings for your email domain. Here is what Google has provided regarding emails sending to SPAM. Note: We provide links to third-party websites in an effort to help you resolve your issue. We are not responsible for the information on third-party websites and we cannot assist with implementing resolutions from these websites. https://support.google.com/a/answer/7663057?hl=en#zippy=%2Cactions-all-users-should-take%2Caction-for-admins-to-take%2Caction-external-senders-can-take

Since the email messages are compliant and it is Google that is routing them to SPAM that is the best angle to address it from."

I guess our families are outta luck