Plan requirement
| Subscription | Any plan |
| Access | Admin |
Checking that incoming mail really comes from who it claims. What it stops, and what it does not.
Turn it on
- Open the email settings in Admin Center.
- Enable authentication checks on incoming email.
- Watch what gets flagged for a couple of weeks.
- Adjust before enforcing anything strictly.
The problem it addresses
Email addresses are trivially easy to forge. Without checks, a message claiming to be from a customer creates or updates a ticket as though it were from them, and an agent has no reason to doubt it.
That is how somebody gets order details, or a password reset, for an account that is not theirs.
What the checks do
They verify that the sending server is authorised to send for that domain. A forged message from a domain with proper records fails the check and can be treated differently.
What they do not do
Nothing about domains with no records of their own, and nothing about a genuine account that has been compromised. Authentication proves the server, not the person.
Watch before enforcing
Legitimate mail fails these checks more often than you would expect: a newsletter tool, a partner's misconfigured server, a forwarding rule. Rejecting immediately means losing real customer email.
Observe first, then tighten.
Tell agents what a flag means
A flagged message is a reason to verify identity before acting on anything sensitive. That is a habit, and it only forms if somebody explains it.
Comments
0 comments
Article is closed for comments.