[ Sending-service guides ]

Authenticate email sent through AcademicWorks (now part of Blackbaud): configuration and verification

Configure AcademicWorks-related sending through Blackbaud Award Management or Stewardship Management with product-specific generated DKIM records.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Use Award or Stewardship Management records, not another Blackbaud product.
  • Preserve institutional DNS and existing authentication policy.
  • Test campus and external delivery with synthetic content.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Test campus and external delivery with synthetic content.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Match Site Email, generated selectors and received signatures for each relevant workflow.

Next steps

  1. Read Site Email before generating records.
  2. Test a synthetic notification to controlled campus and external recipients.
  3. Retest after a sending-domain or DNS-provider change.

CISO / SecOps

Control the authorization boundary

Protect applicant data during tests and keep institutional policy changes under central ownership.

Next steps

  1. Exclude applicant information from test content.
  2. Review custom signing authority without weakening institutional DMARC.
  3. Retain the approved recovery and supplier-retirement decisions.

Founder / Non-technical

Own the sending decision

Schedule authentication work around application and award-notification deadlines.

Next steps

  1. Coordinate the window with award and application deadlines.
  2. Assign central IT ownership for shared institutional policy.
  3. Require the controlled-message acceptance record before launch.

[ FAQs ]

Frequently asked questions

Which current products does this guide cover?

Blackbaud Award Management and Stewardship Management, using their documented DMARC DNS Setup workflow.

Blackbaud Award Management DMARC DNS Setup

Where is the sending domain found?

Use the portion after @ in Site Email, then verify it against an actual received message.

Blackbaud Award Management DMARC DNS Setup

Must DMARC already be configured?

The product-specific setup guide says to verify that before its custom-domain setup steps.

Blackbaud Award Management DMARC DNS Setup

Can I use another Blackbaud product’s selector?

No. Copy the generated records from this product’s configuration.

Blackbaud Knowledgebase 189861

Is generic provider DKIM enough for my university From address?

Not necessarily. The passing signing domain must align for DKIM to satisfy DMARC.

Blackbaud Knowledgebase 189861

Should I test with real scholarship data?

No. Use an authorized test workflow and synthetic content without exposing applicant information.

Does successful Verify prove inbox delivery?

No. It verifies configuration; inspect a received message and relevant local filtering separately.

What belongs in a support escalation?

The product, workflow, exact sending domain, expected public records, DNS answers and redacted receiver headers, not private keys or applicant data.

[ Sources ]

Sources

  1. Blackbaud acquisition of AcademicWorks

    Sections §3 April 2017 acquisition announcement

  2. Blackbaud Award Management DMARC DNS Setup

    Sections Set up DMARC compliant emails: prerequisite and steps 1–7

  3. Blackbaud Knowledgebase 189861

    Sections Products; custom DKIM; steps 1–7

  4. RFC 7208 SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  5. RFC 6376 DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  6. RFC 9989 DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

[ Glossary ]

Glossary

Alignment
The required relationship between a passing authentication domain and the visible From domain for DMARC.
Selector
The DKIM label used with the signing domain to locate its public key in DNS.
Authoritative DNS
The nameserver service responsible for publishing the relevant zone records.
Return-Path
The received-message trace of the SMTP reverse path, useful when investigating the envelope identity.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base