Email domain setup FAQs

• SPF (Sender Policy Framework) - SPF checks that the mail server sending an email is allowed to send messages for your domain.
• DKIM (DomainKeys Identified Mail) - DKIM adds a digital signature to each message, proving that it’s authentic and hasn’t been changed during delivery.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance) - DMARC uses SPF and DKIM to confirm that emails come from your domain and haven’t been forged.

If any of your DMARC policies are set to strict, please contact Tipalti support before making any changes.

The Return Path (also known as the “envelope sender”) tells receiving mail servers where to send bounce or delivery failure messages. It’s hidden from most users but is key for authentication and managing delivery issues.

1. Tipalti creates DKIM keys (public and private).
2. The public key is hosted under tipalti.com; the private key stays secure in AWS SES.
   Tipalti hosts the DKIM public key as a TXT record under a subdomain of tipalti.com (for example: <customer-domain>.dkim.tipalti.com).
3. You add a CNAME record in your DNS pointing to Tipalti’s DKIM record.
4. SES verifies ownership.
5. Once verified, Tipalti can send DKIM-signed emails for your domain.

Why this is secure:

• The CNAME lets mail servers find Tipalti’s DKIM key automatically.
• Tipalti handles key rotation and security.
• You only add one simple DNS record—no key management needed.

Some organizations only accept emails from approved IP addresses (IP whitelisting).

By default, AWS SES uses shared IPs that can change over time. Tipalti offers dedicated IPs, which are fixed and exclusive to Tipalti for your domain. Enabling the dedicated IPs option ensures that users in your domain receive emails from a list of static IPs. This does not apply to emails sent to your payees.

How to enable:

• Go to the Domain Registration page and enable static IPs.
• You can view the full list of Tipalti’s current IPs here: https://ips.tipalti.com/prod-email-ips

By default, emails display a Return Path, e.g., something@amazonses.com.

A Custom MAIL FROM lets you use your own subdomain, like bounce.yourdomain.com.

Benefits:

• Branding: Removes “mailed-by: amazonses.com” from message details.
• Filtering: Makes it easier to route or archive emails internally.
• Consistency: Aligns all technical email fields with your domain.

How to set it up:

1. Contact Tipalti Support.
2. Choose a subdomain (e.g., bounce.yourdomain.com).
3. Tipalti will provide MX and TXT DNS records to add to your DNS.
4. Once verified, the feature will be activated for your domain.

Result:

Your emails’ Return-Path and “mailed-by” fields will reference your domain.

Amazon SES keeps a suppression list of email addresses that shouldn’t receive mail.

Addresses are added if:

• They bounced permanently.
• The recipient server rejected them.
• They caused spam complaints.

If an address is on the list, Tipalti emails to that address won’t be delivered.

To remove an address:

1. Contact Tipalti Support.
2. Provide the affected email address(es).
3. Tipalti will request removal through Amazon SES.
4. Once cleared, messages will resume normal delivery.

Tipalti uses TLS (Transport Layer Security) to encrypt emails while they’re being sent.

Default behavior:

• Uses the strongest available encryption (TLS 1.3).
• Falls back to older versions if needed.

When TLS 1.3 is required:

Some sensitive messages (like Tipalti Card notifications) require TLS 1.3 only. If the recipient’s mail server doesn’t support it, those emails won’t be delivered for security reasons.