Email settings

Overview

As of version 8.0.2, it is possible to send emails via Postmark. This platform provides more possibilities to optimize email sending from Wise. The main improvement is that it is possible to control both SPF and DKIM alignment (both FROM: and RETURN-PATH: use the same domain name).Bounce handling is also improved, as Postmark handles this automatically. Finally, there is a distinction between targeted e-mail and newsletters. With the default sending method (before Postmark is in use), all emails are sent in order. When emails are sent via Postmark, targeted emails (RSO, HR1, IV1, etc.) take precedence over newsletters and marketing messages.

Configuration

Two DNS records must be created for each domain sending emails from Wise. The details for this are sent to the administrator for each Wise system. See below for an example:

domain: library.co.uk
20250619111042pm._domainkey  TXT  k=rsa;p=MIGfMA0GCSqG......
wise-bounces  CNAME  pm.mtasv.net

A TXT record and a CNAME must be created. This can be done as soon as the data is received, and 8.0.2 does not need to be active for that.

FAQ

Question	Answer
Does the DNS have to be set up for all domains before we can go to 8.0.2?	No, in 8.0.2 the old method of sending is still used. It is recommended to set up as much as possible now (during 8.0.1), so that the transition with 8.0.2 can be done quickly.
Can I also choose to continue sending the old way?	Yes, during 8.0.2 you still can, but in 8.0.3 the old mailer will be disabled.
Do I need to set up DMARC now?	No, that is optional. But if the domain sends more than 5,000 emails per day (not just through Wise, but total), Microsoft will reject them. Chances are that this move will also be followed by Google. Those mandate DKIM or SPF, but not DMARC yet. With this change, Wise is completely ready for DMARC, but to turn it on, you must ensure that all emails sent on behalf of the domain meet the DMARC requirements, i.e. that SPF and DKIM are in order. DMARC is therefore turned on in phases (see DMARC below).
Do I also need to change my SPF record?	No, that is automatically taken care of by the settings in Postmark.
Can I delete the old SPF and DKIM data now?	You can only do that once Postmark is actually in use. Until then, emails still need to be signed with the old keys.
What happens when I attach an email address with a new domain to a branch?	As long as the DNS is not yet set up, as of version 8.0.3 no emails will be able to be sent. However, from 8.0.2 it is possible to enter the domain via the Manager earlier, and then the necessary DNS data will also be visible in the Manager within a day. These can then be entered into DNS beforehand, and then the address can be entered at the branch location.
Should the new records be sent via a secure method?	No, these DNS records are intended to be public. They can be accessed through the public DNS after setup.
Is there a way to check if the domains are set up properly?	This is not possible now in 8.0.1, but starting from 8.0.2, it is possible to add and check the postmark configuration in the Wise Manager.
Should I create the DNS records in my internal or external DNS?	They should be created in the external DNS.
From what address are emails sent from Wise?	Emails are sent from an envelope address or MAIL-FROM: <wise system name>@wise-emea.oclc.org. However, customers normally only see the FROM: address, for which the address set in the branch is used.
How can I see which bounces have been processed and what the consequence is?	The bounce parser tries to handle as many bounces as possible automatically. A daily report of this is written in the dashboard in the Manager. If necessary, the processed bounces can be consulted in the query tool in the Manager in the table actor_e_bounces. If a bounce is actually processed, then the bounce counter at the borrower's email address is incremented. This can be accessed in the table actor_e_bounces with type=‘EML’. When too many bounces have occurred, the type of EML is converted to EMLB, and Wise no longer uses this address. It can still be accessed in the Client in tab 4 of the client administration.

Additional Postmark resources

 The websites below provide more information about Postmark:

• https://postmarkapp.com/guides/dkim
• https://postmarkapp.com/support/article/910-how-do-i-add-a-custom-return-path

SPF record

Ensure that the SPF record of the domains used as sender includes:

include:oclcspf3.oclc.org

Any old references can be removed. Examples include:

• 193.240.184.7
• include:spf.hostedwise.nl
• include:oclcspf1.oclc.org
• include:oclcspf2.oclc.org

DKIM records

For the e-mail to be signed, the following records must be created in the domains used as the sender. Once that is in place, it must be passed to OCLC so that the e-mail can actually be signed:

wise1._domainkey         CNAME                 300         dkim1.wise.oclc.org.
wise2._domainkey         CNAME                 300         dkim2.wise.oclc.org.
wise3._domainkey         CNAME                 300         dkim3.wise.oclc.org.
wise4._domainkey         CNAME                 300         dkim4.wise.oclc.org.

DMARC record

When a DMARC record is set for a sender domain, the SPF record must also be updated and the DKIM records placed. Otherwise, the OCLC mail server will be marked as a spammer. 

 Note: If this is not possible, the branch must be set to never send emails.

Set up a bounce parser

Because repeatedly sending from a wrong address causes the mail server to be marked as a spammer, it is very important to have the bounce parser turned on. This quickly removes incorrect addresses from the database so that they are not used again and again.

SPF

An SPF record indicates which servers are allowed to send e-mail from a domain name. This is a TXT record in the DNS of that domain. For example, for library.co.uk, an SPF record may exist as:

bibliotheek.nl.         3600    IN      TXT     "v=spf1 ip4:1.2.3.4 ip4:100.100.100.100 ip4:123.123.123.0/24 include:oclcspf3.oclc.org include:_spf.google.com ~all"

This means that email may be sent from the listed IP addresses and from the addresses set in oclcspf3.oclc.org and _spf.google.com.

There can be only 1 SPF record per domain and no more than 10 DNS lookups should be required to determine the addresses in the SPF record. An ip4: reference does not cost a lookup, but an include: and mx: reference, for example, does.

 Note: DNS references in an included record also count as a lookup.

MXToolbox or dmarcian can be used to check an SPF record. For more information, see: https://kinsta.com/nl/kennisbank/spf-record/

DKIM

When an e-mail is sent from a domain, the message can be signed, preventing the content from being changed in transit. In addition, signing allows verification that the e-mail actually comes from the domain of the sender's address (FROM:).

Because new keys are sometimes put into use, multiple DKIM records are usually set. This allows older e-mails to continue to be validated for a while when the new key comes into use. To indicate which key is used, DKIM has a so-called selector. Wise uses the selectors wise1, wise2, wise3 and wise4.

These keys must be included in the DNS of the sending domain, but the Wise server must know them in order to sign the e-mails during transmission. To enable this, OCLC publishes the DKIM records, and a reference to these DNS records must be included in the DNS of the sending domains.

MXToolbox (enter the form as “domain:wise1” to check selector wise1) or dmarcian can be used to check a DKIM record.

DMARC

DMARC is used to enforce a policy that determines what to do if the SPF or DKIM are incorrect. A DMARC record looks like:

_dmarc      3600    IN      TXT     "v=DMARC1; p=none; rua=mailto:youraddress@yourdomain.com"

"p=" indicates the policy, which can be none, quarantine and reject. Notifications about rejected e-mails are sent to the rua= address. It is advisable to always try DMARC with "none" first and monitor the reports carefully to see if any adjustments to the SPF or DKIM are needed. If everything seems fine, a stricter policy can then be enforced. Never suddenly start with ‘reject’, because it is likely that a lot of valid e-mails will be rejected.

MXToolbox or dmarcian can be used to check a DMARC record. For more information see: https://mailtrap.io/blog/dmarc-explained/