ecosio uses Amazon Web Services Simple Email Service (AWS SES) for SMTP forwarding. AWS SES provides automated bounce and complaint handling to maintain sender reputation and supports industry-standard authentication methods such as DomainKeys Identified Mail (DKIM), Sender Policy Framework (SPF), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).

There is no need to make changes to your existing email server or Exchange server, as the configuration is entirely Domain Name System (DNS) based.

Set up a custom domain

The setup for a custom domain requires coordinated steps between you and ecosio. A one-time setup fee applies. Contact your ecosio Account Manager for specific pricing.

Initial configuration

You must first define the sending domain and address initial requirements.

1. Contact ecosio to request custom domain setup.
2. Define the desired subdomain with ecosio, for example edi.example.com.
3. Receive setup fee information from your ecosio Account Manager.

DNS configuration

ecosio provides you with the following DNS records. You must add these records to your domain configuration to authorise ecosio to send emails on your behalf. The following is an example of the DNS record format you will receive. The actual values will be specific to your configuration.

# DKIM Records (CNAME)
[token1]._domainkey.edi.example.com [token1].dkim.amazonses.com
[token2]._domainkey.edi.example.com [token2].dkim.amazonses.com
[token3]._domainkey.edi.example.com [token3].dkim.amazonses.com

# SPF Records
MX mf.edi.example.com 10 feedback-smtp.eu-central-1.amazonses.com
TXT mf.edi.example.com "v=spf1 include:amazonses.com -all"

# DMARC Record
TXT _dmarc.edi.example.com "v=DMARC1; p=reject;"

DKIM records

ecosio will provide you with three Canonical Name (CNAME) records, which enable DKIM authentication. DKIM cryptographically signs emails to prove they originated from an authorised source. They use the format [token]._domainkey.[your-subdomain] and point to AWS SES endpoints.

SPF records

The SPF records define which mail servers are authorised to send email on behalf of your domain.

• A mail exchange (MX) record directs bounce and complaint messages to ecosio’s AWS SES infrastructure. It uses the format mf.[your-subdomain] and points to the 10 feedback-smtp.eu-central-1.amazonses.com AWS SES endpoint.
• A text (TXT) record contains the actual SPF policy, and uses the format "v=spf1 include:amazonses.com -all". This policy explicitly authorises AWS SES to send on your domain's behalf.

DMARC record

The DMARC protocol protects against email spoofing. The strict rejection policy p=reject protects against domain abuse, meaning receiving mail servers reject any email claiming to be from your subdomain that fails authentication. The DMARC record uses the format _dmarc.[your-subdomain] with policy "v=DMARC1; p=reject;".

Verification and testing

After setting up your custom domain, the following steps require coordination between you and ecosio to confirm the activation of all DNS records and the functionality of the sending configuration before production.

1. ecosio verifies DNS propagation, which typically takes 24 to 48 hours.
2. ecosio configures sender aliases and SMTP connectors.
3. Perform testing with ecosio using sample documents to confirm successful delivery. Standard document formats are supported, including PDF, XML, and other common e-invoice formats such as ZUGFeRD and XRechnung.
4. The custom domain is ready for production.

Security and control

The custom domain approach offers a highly secure method for sending electronic documents. The risk profile is like connecting ecosio to your own Exchange server, but the custom subdomain provides better isolation and simpler revocation.

Infrastructure and access security

Comprehensive security layers protect the service.

• AWS SES which is SOC 1, SOC 2, SOC 3, PCI DSS, and ISO 27001 certified.
• Each custom domain is configured as a separate SES identity with isolated permissions.
• All emails are transmitted over encrypted channels, using an SSL/TLS certificate.
• Role-based access control (RBAC) ensures only authorised ecosio personnel can configure customer domains.

Email authentication

The combination of DKIM, SPF, and DMARC provides strong anti-spoofing protection. DKIM signatures are applied to every email, cryptographically signing it and enabling recipients to verify authenticity. Recipients can verify DKIM signatures in email headers to confirm your DNS configuration authorised the email and AWS SES infrastructure sent it.

Risk mitigation

If ecosio infrastructure is compromised, the following security layers mitigate the risk to your domain.

• ecosio maintains enterprise-grade security practices and certifications. Inquire with the Chief Information Security Officer for current certification status.
• You keep control via DNS records and can revoke authorisation at any time by removing the records. This immediately revokes ecosio's ability to send emails from that subdomain.

Operational security and auditing

ecosio actively manages the operational security of the service.

• Bounces are automatically routed to AWS SES infrastructure and processed by ecosio’s bounce handling system. Email addresses that generate hard bounces are added to suppression lists.
• Bounce rates and complaint rates are actively tracked and maintained below 5 percent to ensure high deliverability.
• Email delivery and reputation metrics are monitored 24 hours a day, seven days a week.
• All email sending activity is logged and available for audit. Contact your ecosio Account Manager to discuss specific audit and reporting requirements.