Genesys Cloud handles incoming emails using AWS Simple Email Service (SES), which scans the messages for malware. If SES detects a virus, or if the virus scan is incomplete or inconclusive, Genesys Cloud automatically disconnects the email, preventing it from being sent to a queue.
Amazon SES authenticates the email and scans it for the following:
- The IP address of the remote host that delivered the email to Amazon SES is checked against the SPF policy specified under the MAIL FROM’s domain used during the SMTP transaction.
- The DKIM signatures present in the email’s header section are checked.
- The email content is scanned for spam and malware.
When SES identifies an email as spam, Genesys Cloud processes it according to the spam routing settings you configured during automatic call distribution (ACD) email address setup. If the SES analysis is inconclusive or fails to mark the email as spam, the email may still be routed to a queue and could reach an agent.
There are also ways of authenticating outbound email to ensure you maintain a good sending reputation. These include:
- SPF: Used to detect spoofing, SPF identifies which mail servers are allowed to send mail on behalf of your MAIL FROM domain. Mail systems refer to the SPF TXT record to determine whether a message from your custom domain comes from an authorized server.
- DKIM: This adds a digital signature to your outbound messages in the email header. The recipient server uses that signature to verify that the email is signed by a key owned by the domain. Because the digital signature stays with the email message no matter what as part of the email’s header, DKIM works even when a message has been forwarded between mail servers, as long as the message content has not been modified.
- DMARC: SPF and DKIM alone don’t ensure that the From address is authenticated; SPF only checks the domain specified in the MAIL FROM address and DKIM only checks the domain specified in the DKIM signature, neither of which are seen by the email recipient. DMARC ensures there is domain alignment with at least one of SPF and DKIM.