Email Spoofing Overview

Who should read this support article?

Anyone who has supplied an email address in ‘Show this ‘From’ address when templated emails are sent’ in the following areas of Rezlynx;

• ‘ini Settings>Email’
• ‘My User Account’
• ‘CRS ini Group Settings > Emails’.

What’s it about?

You can mask (spoof) emails sent from Rezlynx so they appear to have come from their own email system. Rezlynx’s ‘From’ email address (UserId.Site@pms.eu.guestline.net) is replaced with a personalised address so they show as sent from (someone@mydomain.com).

Unfortunately, most email hosts (i.e. @gmail.com) would see this ‘masked’ email as a potential phishing scam (where criminals impersonate legitimate organisations via email, text message, advertisement or other means in order to steal sensitive information). If a mail provider receives too many ‘masked’ (spoofed) emails from a given domain (i.e. @pms.eu.guestline.com) that email provider may end up routing emails to spam/junk folders. Or worse still, permanently block emails from that domain.

Of course, there are legitimate cases for spoofing an email address. As is the case within Rezlynx. However, there needs to be a system for recipient mail providers to know when it is legitimate.

There are 2 systems available for us to use:

• SPF records (Sender Policy Framework)
• DKIM (DomainKeys Identified Mail)

The latter of these ensures that messages are not altered during transit from sender to recipient. It’s a newer system that’s been adopted by many mail providers which means that SPF records alone are no longer sufficient.

What needs to be done?

You must insert the relevant SPF & DKIM records into your DNS server.

Important: This is only possible for customers who have their own domain and is not applicable if you wanted to use a FROM address of @gmail.com, @hotmail.com, etc.

The next section shows you how to do this: DKIM Record Setup

What happens if I don’t ensure SPF & DKIM records are in place?

If the SPF & DKIM records are not placed in your DNS server then emails sent from Rezlynx will ignore the requested masked address and the ‘from’ address of the email will use the default Rezlynx domain.