OneSpan Sign Developers: Email Templates – Part 2

Email customization is an important part of OneSpan Sign’s white-labelling capability. It allows you to deliver a signing ceremony that is consistent with your brand.

In this blog, we will pick up where we left off in part 1 and introduce the three ways you can deliver email notifications. Without further delay, let’s get started!

Using OneSpan Sign's Email Server 

With the default setup, emails will be sent from OneSpan Sign’s domain and requires no changes on your part.

Using a Custom SMTP Server 

If you are looking to send emails from your organization’s domain, one of the options you can choose is to use SMTP forwarding. To do so, you will have to provide the support team with the following parameters:

{
   "email.smtp.host": "",
   "email.smtp.port": "",
   "email.username": "",
   "email.password": "",
   "email.smtp.ssl": "false/true",
   "email.smtp.tls": "false/true" 
} 

It is important to note that if you choose to use SMTP, you will have to register a callback listener and handle bounced emails on your end, which typically occur when the recipient’s email username or domain doesn’t exist or has configured automated reply for out-of-the-office.

When OneSpan Sign receives a bounce back, its response is to send a notification email to the sender mentioning their transaction was not received by the recipient (above screenshot). In addition, it will also send out a callback notification if a listener has been set up and subscribed to the “bounced email” event, with a payload similar to below:

{"@class":"com.silanis.esl.packages.event.ESLProcessEvent","name":"EMAIL_BOUNCE","sessionUser":"3f4280bf-1d9c-4d3b-9c05-5eebdc21afc9","packageId":"Nj8QcYo68fTSA6d5_o0pdpuaEfw=","message":"OOTO","documentId":null,"createdDate":"2020-12-29T15:59:59.306Z"}

Note: There are two available values for the “message” parameter: "BOUNCE" and "OOTO". They tell your listener whether the event was triggered because the email is invalid or because of the OOTO reply.

Based on the bounces from OneSpan Sign, the client side has to handle the callback notification and automatically notify the sender accordingly.

Using DomainKeys Identified Mail (DKIM) Signing with Custom Domain

On top of using a custom SMTP server, another option to send emails from your custom domain is to configure DKIM signing. DKIM is an email security standard designed to make sure messages aren’t altered in transit between the sending and recipient servers. Sender server uses a private domain key to encrypt outgoing mail headers and recipient server later retrieve the public key from the domain's DNS records and decrypt incoming headers and verify that the message does indeed come from your domain and hasn't been modified along the way. 

Default emails are DKIM signed by OneSpan Sign’s domain, however, OneSpan Sign also offers the option to register DKIM by your custom domain. By following this approach, you can greatly improve your email’s chances of not being labeled as spam, improve email deliverability, and further build a reputation on your domain over time.

Please be aware that setting up DKIM with OneSpan Sign is a paid service and will require some time to get started. For more details, please refer to this sender guide and contact your professional services consultant.

Through today’s blog, we’ve explained the three methods to deliver the email notifications and the points to note if you choose to provide your custom SMTP server or configure DKIM with your own domain.

If you have any questions regarding this blog or anything else concerning the integration of OneSpan Sign into your application, visit the Developer Community Forums. Your feedback matters to us!

OneSpan Developer Community

Join the OneSpan Developer Community! Forums, blogs, documentation, SDK downloads, and more.

Join Today