HRTMS provides the email allowlist recommendations generated by the system.

Overview

JDXpert generates emails during the job description life cycle.
- For example, notification emails for managers during the review process, emails for administrators to review integration results, emails for ad-hoc review participants, and so on.
HRTMS uses Sendgrid to deliver emails and ensure the sending servers are using “clean” IPs (IPs that are never involved in spam delivery), and provide email signing using widely accepted certificates.
During implementation, the system generates emails “on behalf” of an active user, creating a direct email interaction between participants involved in the job description reviews. This may create issues in a few corporate setups when the originating email server has the HRTMS domain (which does not match the sender’s email address domain). In order to resolve this, an email allowlist is used.
JDXpert never sends emails with spam or solicitations.
HRTMS works with several corporate clients to develop email allowlist recommendations based on the email header contents.

There are four validation rules used to verify the origin of the incoming emails sent by JDXpert:

Email validation #1: DKIM signature

Every email generated by the application has a DKIM signature which can be used to verify the authenticity of the email and its origin. The DKIM signature may look like this:

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=hrtms.com;

h=mime-version:from:to:subject:content-type; s=smtpapi;

bh=yXwx7n9skXipkuctYt3A31PGnP0=; b=w1ZegqBdSxxHOITwhfB2Y446VQm1+

z+M9GSxemAx8xYb8xb/fFJsWHMR/kY8Mz6YmYTLk9fpzT4cHjjhLdXPkEzbn6Fql

ZuJ84CKE7zW1kbNPEIn9RwK4/jZxg8gLg9sDtPlA+ZjHa4K0i+F2/Fi9SEq2j0AG

jxdCsxJwVW3Bkg=

Perform the following steps for the DKIM validation:

Verify the originating domain name – it must be “hrtms.com” (d=hrtms.com;)
Verify the signature contents against the incoming email (if any of the email contents were altered, the signature validation will fail)

Email validation #2: Originating server

The originating server should be the 1^st or 2^nd entry in the “Received:” chain of the involved servers. The originating email server will always be Sendgrid.net based:

Received: by filter0007p3iad2.sendgrid.net with SMTP id filter0007p3iad2-22398-5AB851B0-62

2017-10-26 01:49:37.170726408 +0000 UTC

Email validation #3: Return-Path

HRTMS is using a specific Return-Path header to receive a confirmation of the delivery and verify if the email was not bounced back due to any errors. The return path should be based on the “sendgrid.softlayer.com” domain and contain the recipient’s email address in the format of “-user=corp.com”, where the recipient’s email is “user@corp.com”:

Return-Path: bounces+165940-a382-user=corp.com@sendgrid.softlayer.com

Email validation #4: Message Id

All email messages have a Message-ID header containing the “sendgrid.net” domain:

Message-ID: <dnGZw-O9So-m_pxINbtFBQ@ismtpd0008p1las1.sendgrid.net>

Email spam/junk

HRTMS sends periodic emails (newsletters, client success follow-up, etc.) to the contacts provided to HRTMS by the client. To ensure the successful delivery of these emails, check emails from the HRTMS domain (@hrtms.com) are not blocked or marked as spam or junk by email software.

Potential firewall issues

If you are experiencing site-blocking issues, set the JDX domain to “Always be allowed” as an initial troubleshooting step. If you see errors such as "This site can't be reached" or "Can't connect securely to this page", it may be because of domain issues.

The following domains should be set to “Always be allowed” depending on the product you are using:

JDXpert Email Allowlist Recommendations