Custom Outbound Email Domains

Customer teams have the option to enable custom domains for emails sent from the PagerDuty Workflow Automation app. For example, a Workflow task that sends an email will deliver it from @{team-name}.customdomain.com. When a custom outbound email domain is set, it applies to all emails sent by a team—it cannot be done for just some emails.

If a custom domain is not set, all emails sent from the PagerDuty Workflow Automation app will default to @{team-name}.pushbot.com.

When you enable a custom domain, we authenticate emails using one or more of the following:

• SPF MX record
• DKIM record
• DMARC policies

Examples of use

A custom domain is useful for teams depending on how they will be using emails. If many users outside the PagerDuty Workflow Automation team will receive e-mails, custom outbound domains can be beneficial for a number of reasons:

• Increase external user trust with consistent company email domains.
• Increase email delivery rate and avoid spam filters.
• Or reduce employee or user confusion if they’re new to Workflow.

How to enable custom outbound email domains

Contact PagerDuty Support if you would like to enable custom email domains. We can also configure a Static IP address range for outbound emails if requested by an administrator.

Example configuration requirements and setup for custom email domains

The following steps are a summary of the configuration requirements and implementation for custom email domains—this is just an overview and at this time, custom email domains must be set up through PagerDuty Support.

Below is a summary of DNS records and a proposed plan for configuration, testing and release. The example uses DKIM-only DMARC validation and amazonses.com as the return-path, but other validation options are available.

Configuration summary

Customer will create the following DNS Entries:

1. Domain verification record - SES validation TXT record
2. DKIM record set - 3 DKIM records are required - to achieve DMARC compliance
3. DMARC record - optional - if an official DMARC policy is required - can be added at a later date

For ease of setup we recommend a Time To Live (TTL) of 300 seconds for all records, but it can be different if customer’s TTL policy requires otherwise.

✅   Heads-up: If you’re ready to enable custom outbound email domains, make sure you are ready for any technical configuration as DNS changes have to be made within 72 hours of starting the process.

Domain verification record

• Name: _amazonses.<custom-domain>
• Type: TXT
• Value: To be provided by PagerDuty Workflow Automation

DKIM record set

• Name: ,Token to be provided by PagerDuty Workflow Automation>._domainkey.<custom-domain>
• Type: CNAME
• Value: <Token to be provided by PagerDuty Workflow Automation>.dkim.amazonses.com

Configuration plan

The following steps outline the typical exchange in setting up the email domain.

Step 1: PagerDuty Workflow Automation

1. Generate tokens - From the time we generate the domain verification and DKIM tokens in Amazon SES, customer will have 72 hours to add the DNS entries. PagerDuty Workflow Automation can generate and send the tokens at any time, but doing so on a Monday, Tuesday or Wednesday will maximize the number of working days for the customer to add the DNS entries.
2. Send tokens to customer

Step 2: Customer

1. Add DNS records
2. Notify PagerDuty Workflow Automation that records have been added

Step 3: PagerDuty Workflow Automation

1. Verify that the records have been validated by Amazon SES
2. Test in a customer’s sandbox team

Step 4: Customer

1. Test in sandbox team team
2. Select go-live plan and date
3. (Optional) Communicate internally and with third parties

Step 5: PagerDuty Workflow Automation

1. On Go-Live date: Enable sending outbound emails from custom domain in production team
2. Test

Step 6: Customer

1. Test to confirm deliverability of emails
2. (Optional) Communicate internally and with third parties