Configuring Jira Cloud to send emails on behalf of your domain

Still need help?

The Atlassian Community is here for you.

Ask the community

Before you begin

The steps outlined on this page should be carried out by an Atlassian Cloud site administrator and a domain administrator.

Domain ownership

For Jira to send email notifications from your own domain, you'll need to prove ownership of the domain. In the past this was done at a site level, but domain claims are now managed using Atlassian Organizations.

You can validate ownership of a domain in two ways:

  1. The site in question is integrated with GSuite where this the domain in question is managed

  2. You've set up an Atlassian Organization with a valid domain claim on your domain

Creating an Atlassian Organisation is free and allows you to manage sites and users as a level above sites and applications. Go to admin.atlassian.com to set up an Organization, then verify your domain using DNS (Follow the DNS process only. Don't use the HTTPS process in this case).

By verifying a domain, you'll begin managing Atlassian users who have accounts set up under this domain. If this isn't something you intend to do, you should contact your organization IT department to set up this domain claim for you.

Note: Claiming a domain will send an email out to all Atlassian accounts using this domain to let the user know their account will be managed under this Organization.

See email content that Atlassian account holders will see...

Changes to your Atlassian account

Hi (user's name),

We're writing to let you know that your Atlassian account is now being managed by your Atlassian Cloud administrator.

This won't change the way you log in to Atlassian products or how you use them. However, from now on if you want to update your email address, you'll need to contact your Atlassian Cloud administrator.

For more info, see Personal and managed accounts.

Cheers,

The Atlassians


DNS records

DNS records will also need to be created to point to Atlassian's managed email provider that will authorize Jira to send emails from the custom email address, and will help protect these Jira emails from being marked as 'unwanted' email. The setting must remain on your DNS configuration and will be automatically re-verified periodically.

Sending emails using a custom 'Project Email Address' with your domain:

For Jira to send emails on behalf of the Project Email Address and ensure email deliverability, SPF and DKIM records for our mail provider must be set on your domain's configuration.

Click here for more details on Email Deliverability (SPF & DKIM) ...

About SPF & DKIM Signatures

SPF and DKIM are two separate strategies used to properly authenticate the emails we send on your behalf. Each will require you to set a DNS records on the domain that Jira will be sending email from on your behalf.

SPF

SPF is short for Sender Policy Framework and answers the question "what IP addresses should my legitimate mail be coming from?" for recipient mail servers. We have a very strict listing of the IP addresses that we send email from, and you'll need to reference our SPF record in your own SPF record.

SPF validation occurs on the recipient end of things (your Jira users receiving notifications).

DKIM

DKIM is short for DomainKeys Identified Mail, and is a way for our email delivery partners to validate that you've given us permission to send email on your behalf. We give you multiple DNS records to set for DKIM because we have multiple email providers, and they each need to know that we've been given permission from you. You setting the DNS records is your way of saying "yep, Atlassian Jira is my friend and can send email for me!".

DKIM validation occurs on the originating end of things (our email provider, the people sending the email).

You can do this by following the steps below: 

1. Configure your domain in your Atlassian Account

As a Site Administrator of Atlassian Cloud follow the 'DNS TXT' verification approach (not the 'HTTPS' approach) outlined in Domain verification -- Verify your domain. This will confirm that you own the 'Project Email Address' domain. After completing this step, the verified domain will show on your "Domains" section as "Verified" with DNS method.

If G Suite is enabled, the domain is managed by G Suite and does not require a Domain Verification. Continue with next step...

2. Configure your domain's SPF records

As a Domain Administrator of your domain, if you have no SPF configured add the text below to your domain's SPF records:

v=spf1 include:_spf.atlassian.net ~all
Expand for examples for setting single or multiple SPF records...

 You can only have one SPF record per domain. However, you can set multiple SPF entries within that record.

Here's a validsingle full record example:

v=spf1 include:_spf.atlassian.net ~all

Here is a validmulti-record SPF example where Google is the second provider.

v=spf1 include:_spf.atlassian.net include:_spf.google.com ~all

Here's an invalid example:

v=spf1 include:provider-1.zyyy -all v=spf1 include:_spf.atlassian.net ~all

3. Configure your domain's DKIM records

As a Domain Administrator of your domain, set the following DKIM records to ensure that Jira is correctly authorised to send mail from your domain using Atlassian's email delivery provider.

s1._domainkey	IN	CNAME	s1._domainkey.atlassian.net.
s2._domainkey	IN	CNAME	s2._domainkey.atlassian.net.

Notes: 

  • '_domainkey' is an authentication method and does not need to be replaced by your domain's name.
  • If you're already using SendGrid to send emails from your domain for another service, you will not be able to add that domain a second time. In this case, it is recommended that you use a subdomain for your 'Project Email Address' setting. For example, use Jira@notifications.company.com instead of Jira@company.com .

4. Validate that SPF and DKIM configurations are correct

Use https://domain-check.atlassian.com tool to verify that everything has been configured correctly. The 'Domain' field in the tool should not include any protocol or subdomains, so remove 'http://' and ''www' from your domain before clicking the 'Check' button. Keep in mind that DNS records may take up to 10 minutes to take effect.

Last modified on Apr 3, 2019

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.