---
title: "E-mail delivery (SMTP)"
url: "https://support.3rdrisk.com/en/article/e-mail-delivery-smtp"
language: "en"
last_updated: "2026-08-27T18:26:16.346Z"
---

# E-mail delivery (SMTP)

Send platform e-mail from your own domain using DNS records.

By default, the e-mail your 3rdRisk environment sends — assessment invitations, reminders, notifications — comes from a 3rdRisk address. Many organisations would rather it came from their own domain, so that a third party receiving a questionnaire sees a sender they recognise and your own security team can vouch for it.

There are two ways to arrange that. This article covers the SMTP route, where you add three DNS records to a sending subdomain. The alternative uses a Microsoft Entra ID app registration instead of DNS records, and is described in a separate article.

Sending through Microsoft instead: [E-mail delivery (Microsoft Entra ID)](https://support.3rdrisk.com/en/article/e-mail-delivery-microsoft-entra-id)

## **Overview**

You choose a sending subdomain, we send you the exact record values for it, you add them to your DNS, and we switch your environment over. The work on your side is three DNS records and takes an IT administrator a few minutes; the waiting is DNS propagation.

**What you need:** access to your organisation's public DNS, and a decision on the sending subdomain.

*Note: 3rdRisk configures the delivery itself. There is no e-mail setting in the platform for this — you add the DNS records, tell us, and we complete it from our side.*

## **1\. Choose a sending subdomain**

Pick a subdomain that mail will be sent from, for example `mail.assessment.your-company.com`. It should be dedicated to this purpose rather than a domain you already send other mail from, because the records below apply to the whole subdomain.

Send your choice to [3rdRiskSupport@diligent.com](mailto:3rdRiskSupport@diligent.com). We reply with the exact values for the three records, including your DKIM public key, which is generated for your subdomain and is not the same for any two customers.

## **2\. Add the three DNS records**

On the sending subdomain, add:

| Type | Name | Value |
| --- | --- | --- |
| TXT (SPF) | your sending subdomain | `v=spf1 include:mailgun.org ~all` |
| TXT (DKIM) | `mta._domainkey.` followed by your sending subdomain | the public key we send you |
| MX | your sending subdomain | `mxa.eu.mailgun.org` |
| MX | your sending subdomain | `mxb.eu.mailgun.org` |

Both MX records are needed, and they carry different priorities — we include those in the values we send.

*Note: if your domain already has an SPF record, do not add a second one. A domain may only have one SPF record, and two will fail validation. Merge the* *`include:mailgun.org`* *into the existing record instead.*

## **3\. Allowlist our outbound addresses**

All outbound traffic from the platform leaves from a fixed, region-specific set of addresses. This covers **SMTP delivery**, **webhooks** and **outbound integration calls**.

Add the set for your region in two places:

-   On your **mail filter**, so messages to your own colleagues are not held.

-   On your **firewall**, so webhooks and integration calls are not blocked.

*Note: use only the set for the region your environment runs in. Allowlisting another region's addresses has no effect.*

**Europe (eu-central-1)**

-   `3.74.251.66`

-   `3.78.117.61`

-   `18.153.113.193`

**United States (us-east-1)**

-   `3.225.129.175`

-   `34.232.175.201`

-   `44.197.19.73`

-   `98.95.201.91`

-   `100.52.54.17`

**Australia (ap-southeast-2)**

-   `15.134.188.237`

-   `54.79.145.33`

-   `54.79.154.52`

## **4\. Tell us the records are live**

E-mail [3rdRiskSupport@diligent.com](mailto:3rdRiskSupport@diligent.com) once the records are in place. We verify them, switch your environment to the new sender, and confirm when it is live. DNS changes can take up to 48 hours to propagate, and until the switch is made your environment keeps sending from its current address, so there is no interruption.

## **Known limitations**

-   **One sending subdomain per environment.** Mail for an environment all leaves from the same sender.

-   **A domain may only have one SPF record.** Merge rather than add.

-   **The DKIM key is specific to your subdomain.** A key from another environment or another customer will fail validation.

-   **This changes who mail comes from, not what it says.** The wording of the messages is configured separately.

Learn more about the content of the messages: [E-mail templates](https://support.3rdrisk.com/en/article/e-mail-templates)