Purpose
This article describes the "best practice" for preventing the rejection of emails that are sent by FlexNet Operations on behalf of an email server belonging to a FlexNet Operations tenant. Without proper authorization by the tenant's domain, these emails can be considered as a form of "spoofing" and are subsequently blocked by the recipient.
This best practice is applicable to only FlexNet Operations deployments in the Revenera-hosted Data Center. FlexNet Operations deployments in Amazon Web Services (AWS) use an internal AWS facility to prevent such emails from being blocked, as described in the user documentation:
Audience
The audience for this article is a Producer acting on behalf a FlexNet Operations tenant. The use of “you” and “your” refer to the Producer and tenant interchangeably.
Need to Know
The Producer Portal enables you to configure and manage email messages that are sent to end users to notify them about new entitlements and other events. These email messages can be generated automatically based on certain event triggers or generated manually as needed.
By default, the emails are sent directly from the FlexNet Operations email server, with the sender identified as belonging to the flexnetoperations.com domain and having an email alias specific to your organization (for example, abc@flexnetoperations.com). The following shows an excerpt from an example email template in FlexNet Operations ALM:
However, you might prefer that FlexNet Operations send these emails of behalf of your (that is, the tenant’s) own email server. If you attempt to simply update the email template to specify your email server address as the sender (the From value), the resulting emails can be blocked by the recipient because the From address appears to be masking the originating sender—in this case, FlexNet Operations. To avoid rejected emails, the domain to which your email server belongs must recognize the domain of the FlexNet Operations email server as authorized to send mail on your behalf.
The next sections describe how to authorize and configure FlexNet Operations so that it can successfully send emails on behalf of your email server:
Authorizing FlexNet Operations to Send Email on Behalf of the Your Email Server
To authorize FlexNet Operations to send email on behalf of your email server, you must set up an SPF (Send Policy Framework) record.
About the SPF Record
The SPF record is a public record that anyone can access. It lists the authorized IP address of each email server belonging to your domain. It also identifies the domain of the FlexNet Operations email server so that it can send email as a third party on behalf of the listed IP addresses. Once the SPF record is created, it published as a DNS record in the DNS registry.
Then, whenever FlexNet Operations sends an email on your behalf, SPF authenticates the IP address of the "sending" email server (belonging to you) to an authorized IP address in your DNS record. SPF also verifies the originating sender's domain (that is, flexnetoperations.com) against the DNS record to verify that FlexNet Operations is indeed authorized as third-party email sender on your behalf. Once all checks clear, the email can reach the recipient.
Setting Up the SPF Record
The following procedure describes how to set up the necessary SPF record.
The record authorizes the FlexNet Operations email server to be a third-party server that can send emails on the behalf the email servers in your domain.
To set up the SPF record:
- Obtain the IP address for each email server on whose behalf FlexNet Operations will send emails to your end users. These email servers must belong to the same domain.
- Contact your IT department to set up an SPF record for your domain. Once the contents are created (see the next steps), the IT department will publish the record to the DNS registry.
- To create the file contents, enter the v=spf1 tag followed by the IP address for an email server:
v=spf1 ip4:1.2.3.4
To list more than one email server belonging to the same domain, leave a space between each address:
v=spf1 ip4:1.2.3.4 ip4:5.6.7.8
- Add an include statement (in the format include:<domain>) to identify the FlexNet Operations domain. This statement identifies the FlexNet Operations email server as a third party that can send emails on behalf of any of the listed IP addresses.
v=spf1 ip4:1.2.3.4 include:flexnetoperations.com
- End the record with an - all tag:
v=spf1 ip4:1.2.3.4 include:flexnetoperations.com -all
SPF records cannot be over 255 characters in length (and cannot have more than ten include statements).
Configuring the Email Template
As a final step in configuring FlexNet Operations to send emails on your behalf, you must configure the email template to specify your email address.
NOTE: The following section describes the process of updating an email template in FlexNet Operations ALM. For LLM producers, contact Revenera Support to assist you with this process.
To configure the email template with your email address:
- In the Producer Portal, click Administer and then select Templates in the Email section to open the list of available email templates.
- Click the link for the email template that will be used to generate the email sent to the end user.
The View Email Template page is displayed showing details for the selected template. - Select Edit > Edit Definition to open the Edit Email Template Definition page.
- In the From field, enter your email address (ensuring the email server used by this address is identified by an IP address in the SPF file).
- (Optional) In the Reply To field, enter the same email address provided in the previous step (or an email address belonging to the same domain).
- Save the edits.
Now when an email generated from this template is sent by FlexNet Operations on behalf your email server, the email will successfully reach the recipient. The recipient will see the sender address as your email address.
