E-mail delivery (SMTP)

By default, the e-mail your 3rdRisk environment sends — assessment invitations, reminders, notifications — comes from a 3rdRisk address. Many organisations would rather it came from their own domain, so that a third party receiving a questionnaire sees a sender they recognise and your own security team can vouch for it.

There are two ways to arrange that. This article covers the SMTP route, where you add three DNS records to a sending subdomain. The alternative uses a Microsoft Entra ID app registration instead of DNS records, and is described in a separate article.

Sending through Microsoft instead: E-mail delivery (Microsoft Entra ID)

Overview

You choose a sending subdomain, we send you the exact record values for it, you add them to your DNS, and we switch your environment over. The work on your side is three DNS records and takes an IT administrator a few minutes; the waiting is DNS propagation.

What you need: access to your organisation's public DNS, and a decision on the sending subdomain.

Note: 3rdRisk configures the delivery itself. There is no e-mail setting in the platform for this — you add the DNS records, tell us, and we complete it from our side.

1. Choose a sending subdomain

Pick a subdomain that mail will be sent from, for example mail.assessment.your-company.com. It should be dedicated to this purpose rather than a domain you already send other mail from, because the records below apply to the whole subdomain.

Send your choice to 3rdRiskSupport@diligent.com. We reply with the exact values for the three records, including your DKIM public key, which is generated for your subdomain and is not the same for any two customers.

2. Add the three DNS records

On the sending subdomain, add:

Both MX records are needed, and they carry different priorities — we include those in the values we send.

Note: if your domain already has an SPF record, do not add a second one. A domain may only have one SPF record, and two will fail validation. Merge the include:mailgun.org into the existing record instead.

3. Allowlist our outbound addresses

All outbound traffic from the platform leaves from a fixed, region-specific set of addresses. This covers SMTP delivery, webhooks and outbound integration calls.

Add the set for your region in two places:

• On your mail filter, so messages to your own colleagues are not held.

• On your firewall, so webhooks and integration calls are not blocked.

Note: use only the set for the region your environment runs in. Allowlisting another region's addresses has no effect.

Europe (eu-central-1)

• 3.74.251.66

• 3.78.117.61

• 18.153.113.193

United States (us-east-1)

• 3.225.129.175

• 34.232.175.201

• 44.197.19.73

• 98.95.201.91

• 100.52.54.17

Australia (ap-southeast-2)

• 15.134.188.237

• 54.79.145.33

• 54.79.154.52

4. Tell us the records are live

E-mail 3rdRiskSupport@diligent.com once the records are in place. We verify them, switch your environment to the new sender, and confirm when it is live. DNS changes can take up to 48 hours to propagate, and until the switch is made your environment keeps sending from its current address, so there is no interruption.

Known limitations

• One sending subdomain per environment. Mail for an environment all leaves from the same sender.

• A domain may only have one SPF record. Merge rather than add.

• The DKIM key is specific to your subdomain. A key from another environment or another customer will fail validation.

• This changes who mail comes from, not what it says. The wording of the messages is configured separately.

Learn more about the content of the messages: E-mail templates