Setting up a .gov.uk email address

Metastreet sends automated emails on your council's behalf. At present these are sent from no-reply@metastreet.co.uk. You can have them sent from an address on your council's own domain instead, for example no-reply@[COUNCIL].gov.uk.

This applies only to the automated emails sent by the system. It does not change how officers send email from their own mailboxes, and it is a single sending address rather than one address per officer.

Nothing is affected while you are making these changes. Emails continue to be sent from no-reply@metastreet.co.uk until the setup is complete and we switch the address over.

In this guide you'll learn how to:

• Understand how the change works and what is involved
• Decide on your sending address and who needs to be involved
• Add the DKIM records to your DNS
• Add a DMARC record, if you do not already have one
• Confirm the changes back to us
• Know what happens once the records are in place

1. How it works

Metastreet sends these emails through Amazon Simple Email Service (SES). For receiving mail servers to accept messages that use your council's domain, they need to verify that we are authorised to send on your behalf.

This is done by adding a small number of records to your council's DNS. There are three DKIM records, which are always required, and a DMARC record, which is only needed if your domain does not already have one.

The records are unique to each domain, so we create them for you and send them across. Once they are in place, we verify them and switch your sending address over.

2. Before you start

1. Decide the email address you want to use, for example no-reply@[COUNCIL].gov.uk. This is a single sending address that replaces no-reply@metastreet.co.uk.
2. Identify who manages DNS for that domain, as they will need to add the records in sections 4 and, where applicable, 5. This is often an internal IT team or an external supplier.
3. Check whether the domain already has a DMARC record. If it does not, decide which mailbox should receive DMARC reports.

3. Confirming your sending address

Send us the exact address you want to use. We then create the domain identity in Amazon SES and send you the three DKIM records for that domain.

The record values are unique to each domain, so they are supplied separately rather than in this guide.

4. Adding the DKIM records to your DNS

Add the three CNAME records we supply. Each record uses the following pattern, where [TOKEN] is the value we provide and [SENDING_DOMAIN] is your domain:

Copy the values exactly as supplied, with no trailing full stop or additional text.

NOTE: Please add all three records. Verification only succeeds once all three are present and resolving correctly.

TIP: Some DNS management tools append the domain to the name automatically. If yours does, enter only the part of the name that comes before your domain.

5. Adding a DMARC record (only if you do not already have one)

If [SENDING_DOMAIN] does not already have a DMARC record, add the following:

Replace [DMARC_REPORT_EMAIL] with the address where you want to receive DMARC reports.

We start with p=none, which is monitoring only. This generates reports on authentication failures without affecting mail delivery, so everything can be confirmed as working before the policy is tightened. Once confirmed, the options are:

• p=quarantine: unauthenticated messages go to spam
• p=reject: unauthenticated messages are rejected outright

NOTE: If a DMARC record is already in place, leave it as it is and let us know what the current policy is.

6. Letting us know once the records are in place

When the records have been added, please confirm the following back to us:

• The exact sending address you want to use
• That all three DKIM records have been added
• Whether a DMARC record was added, or whether one was already in place and what its current policy is
• The address receiving DMARC reports, if a new DMARC record was added

7. What happens next

Once you confirm, we re-run the verification in Amazon SES and then switch the sending address over.

DNS changes can take some time to propagate, so verification may not succeed immediately after the records are added. If it does not, we will check again.

Nothing is affected while you are making these changes. Emails continue to be sent from no-reply@metastreet.co.uk until verification has succeeded and we switch the address over.

8. Getting help

If you have any questions, want more information, or want to check that the changes have been implemented correctly, contact your account representative or email us at team@metastreet.co.uk.