To ensure important emails sent from the Tassel Hub successfully reach your graduates, your institution must verify the domain used to send email through Tassel.
Tassel has moved to Postmark as our email delivery provider. As part of this change, every domain used to send email from the Tassel Hub must be registered and verified with Tassel before it can be used.
If your sending domain is not verified, emails from that domain will not send.
Setting up your sending domain requires coordination between your Tassel Implementation Manager and the team that manages DNS for your institution, typically your IT department.
The process is:
Confirm the domain you want to send from.
Send the domain to your Tassel Implementation Manager.
If you are an existing customer, you can skip steps 1 & 2 - we already have your domain on file.
Tassel will provide the DNS records specific to your domain.
Your IT team will add the records to your DNS.
Let your Implementation Manager know when the records have been added.
Tassel will verify the domain and confirm when it is ready to use.
DNS changes may take up to 48 hours to propagate and verify.
First, determine which domain your institution will use when sending email from the Tassel Hub.
For example, if you plan to send email from:
your sending domain is:
university.edu
If you already send Tassel communications from an institutional email address, you can continue using that domain as long as it is registered and verified with Tassel.
You may also use a dedicated subdomain specifically for email sent through Tassel.
For example:
tassel.university.edu
or
commencement.university.edu
Your sending address could then be:
grads@commencement.university.edu
Using a subdomain can help separate Tassel email authentication from other email systems used by your institution.
If you need to send from more than one domain, each domain must be registered and verified separately.
For example, if your institution needs to send from both:
university.edu and alumni.university.edu
both domains must complete the verification process.
Send the complete list of domains you intend to use to your Implementation Manager.
Your Implementation Manager will coordinate the registration of each domain with Tassel's IT team and they will provide the DNS records your IT team needs to publish.
DNS records are generated specifically for your sending domain.
Do not copy DKIM records from another institution, another domain, or an older Tassel configuration.
Wait until the Tassel IT team provides the records for your domain.
DKIM is required.
DKIM, or DomainKeys Identified Mail, allows receiving email providers to verify that Tassel is authorized to send email on behalf of your institution.
Tassel Tech Support will provide your institution with a unique DKIM record containing:
Type: TXT
Host: Provided by Tassel
Value: Provided by Tassel
The host will look similar to:
[selector]._domainkey.university.edu
The value will be a long string beginning with:
k=rsa;p=...
Your IT team should publish the Host and Value exactly as provided by Tassel.
Do not modify, shorten, re-key, or otherwise alter the DKIM value.
Strongly recommended
Along with your DKIM record, Tassel will provide information for configuring a Custom Return-Path.
The Return-Path is used for email bounces and delivery feedback. Configuring a Custom Return-Path also allows email sent through Tassel to better align with your institution's domain for authentication purposes.
The record is:
Type: CNAME
Host: pm-bounces.university.edu
Value: pm.mtasv.net
Replace university.edu with the sending domain you registered with Tassel.
For example, if your sending domain is:
commencement.university.edu
the Host would be:
pm-bounces.commencement.university.edu
Adding this record does not affect other email sent from your domain or change your institution's existing email configuration.
Although the Custom Return-Path is not required to verify your sending domain, Tassel strongly recommends adding it to improve email authentication and deliverability.
Once your IT team has published the DNS records, Tassel will automatically check the domain from our side and confirm once verification has succeeded.
You do not need to send the records back to us—we already have the values associated with your domain.
Please allow up to 48 hours after making DNS changes for them to propagate and verify.
Your Implementation Manager will inform you once configuration is complete and to send a test email from your hub.
Your IT or DNS administrator can add the records provided by Tassel using your institution's DNS provider.
Sign in to your Domain Portfolio.
Select your domain.
Select DNS > Add New Record.
Select TXT for the DKIM record or CNAME for the Return-Path.
Enter the Host and Value provided.
Save the record.
Log in and select your domain.
Go to DNS > Records.
Select Add Record.
Select TXT for DKIM or CNAME for the Return-Path.
Enter the Name and Content.
Save the record.
Sign in to the Microsoft 365 admin center or Azure portal.
Navigate to Settings > Domains or your DNS zone.
Add the TXT record provided by Tassel for DKIM.
Add the CNAME record for the Custom Return-Path.
Save your changes.
Open the Route 53 console.
Select your hosted zone.
Select Create Record.
Create a TXT record using the DKIM information provided by Tassel.
Create a CNAME record for the Custom Return-Path.
Save your changes.
Open the Cloud DNS console.
Select your managed zone.
Select Add Record Set.
Create a TXT record using the DKIM information provided by Tassel.
Create a CNAME record for the Custom Return-Path.
Save your changes.
Log in and go to Domain List.
Select Manage next to your domain.
Select Advanced DNS.
Add a TXT record using the DKIM information provided by Tassel.
Add a CNAME record for the Custom Return-Path.
Save your changes.
You do not need to modify your SPF record for Tassel.
Previous Tassel email configuration required institutions to add Elastic Email to their SPF record. This is no longer required with our Postmark configuration.
If you already have an SPF record for other email services, leave it in place. There is no need to add Postmark to that record as part of the standard Tassel verification process.
If your existing SPF configuration uses macros or you have questions about a more complex email authentication setup, contact the Tassel Support Team for assistance.
If your institution previously configured DNS records for Tassel's former email provider, do not remove those records yet.
Complete the new Postmark verification process first.
Your Implementation Manager will confirm when your institution has successfully transitioned and advise you about any previous Tassel records that can safely be removed.
Once verification is complete, email sent from the Tassel Hub must use an address belonging to one of your institution's verified domains. Please update your email templates accordingly.
For example, if:
university.edu
has been verified, you could send from:
Email can no longer be sent using a tassel.com address or another generic Tassel sending address.
If an email template is configured with a sending address that does not belong to one of your institution's verified domains, the email will not send.
If you later want to use a different domain, contact your Implementation Manager before changing your sending address. The new domain must be registered and verified first.
Most institutions do not need to allowlist Postmark's IP addresses.
However, if your institution's mail gateway or firewall restricts incoming email based on sending IP addresses, your IT team may need to allowlist Postmark's outbound SMTP servers.
Because Postmark's IP ranges can change, always use Postmark's current IPs for Firewalls documentation rather than relying on a saved or static IP list.
IP allowlisting is optional and does not replace the required DKIM verification.
First, confirm that the domain in your sending email address has been registered and verified with Tassel.
Emails from an unregistered or unverified domain will not send.
Sending from a previous tassel.com address is also no longer supported.
Contact the Tassel Support Team to confirm your domain's verification status.
Allow up to 48 hours for DNS changes to propagate.
If the domain still isn't verifying, ask your IT team to confirm:
The Host and Value were entered exactly as provided.
The DNS provider did not automatically add your domain to the Host a second time.
The DKIM value was not truncated when it was copied and pasted.
No additional spaces or line breaks were added to the value.
For example, some DNS providers automatically append your domain. This can accidentally create:
selector._domainkey.university.edu.university.edu
instead of:
selector._domainkey.university.edu
If you're still unable to verify the domain, contact the Tassel Support Team.
Each sending domain must be registered and verified independently.
Send your complete list of domains to your Implementation Manager, and Tassel will provide the appropriate records for each one.
DNS records are typically managed by your institution's central IT or network administration team.
Share these instructions and the records provided by Tassel with whoever manages DNS for your institution.
If you're unsure who should complete the changes or need additional assistance, contact the Tassel Support Team.
No.
SPF changes are no longer required for Tassel's standard email configuration.
Leave your institution's existing SPF record unchanged unless your IT team has another reason to modify it.
Not yet.
Leave your existing Tassel/Elastic Email records in place while your institution completes the Postmark transition.
Your Implementation Manager will confirm when your migration is complete and provide guidance about removing previous records.
If you have questions about your sending domain or need the DNS records for your institution, contact your Tassel Implementation Manager.
If you're experiencing a technical issue or need help troubleshooting your verification, contact the techsupport@tassel.com.
We'll help you determine the next step and confirm when your domain is ready to send email through Tassel.