You set the From address on your Altru acknowledgment or eTicket email to tickets@yourmuseum.org, send a test, and it lands in spam, or doesn’t arrive at all. Then IT mentions they just tightened the domain’s DMARC policy. Those two things are almost always connected.
This guide explains what DMARC actually checks, why an email sent by Altru using your address can fail it, and how to work with Blackbaud and your IT team to get the From address and the authentication to line up.
The short version
When you put your own domain in the From line, receiving mail servers (Gmail, Outlook, Yahoo) ask your domain whether that sender is allowed to use it. Your domain answers through three DNS records: SPF, DKIM, and DMARC. Altru’s email doesn’t come from your mail server. It goes out through Blackbaud’s sending infrastructure. Unless your DNS vouches for that infrastructure in a way DMARC accepts, the message looks like someone spoofing your domain, and a strict policy tells the receiver to quarantine or reject it.
Since 2024, Google and Yahoo have required bulk senders to have DMARC in place, so many organizations that never thought about this now have a policy on their domain, sometimes set by IT without anyone telling the membership or ticketing team.
What DMARC is really checking
The part that trips people up is alignment. Passing SPF or DKIM is not enough on its own. DMARC passes only if at least one of these is true:
- SPF passes and aligns: the sending server is authorized by SPF for the “envelope” or return-path domain, and that domain matches your From domain.
- DKIM passes and aligns: the message carries a valid DKIM signature, and the signing domain (the
d=value) matches your From domain.
A vendor platform will often pass SPF and DKIM for its own domain. That’s fine for the vendor, but it doesn’t align with yourmuseum.org, so DMARC still fails. This is why “just add Blackbaud to our SPF record” frequently doesn’t fix anything: if the return-path domain belongs to the sending platform, your SPF record isn’t the one being checked.
Step 1: Look at what’s happening now
Before changing DNS, find out how Altru mail is currently being authenticated. The easiest way:
- Send a real Altru email (an acknowledgment, eTicket, or test communication) to a Gmail address.
- Open it in Gmail, use the message menu, and choose Show original.
- Note the SPF, DKIM, and DMARC results at the top, and in the raw headers look at the Return-Path domain and the
d=domain in the DKIM-Signature header.
If SPF and DKIM both pass but for a domain that isn’t yours, you have an alignment problem. If DMARC already says PASS, your setup works and you can stop worrying, at least until someone changes the DNS.
Also ask IT for your current DMARC record (it’s a TXT record at _dmarc.yourdomain.org). The p= value tells you how strict it is: none only monitors, quarantine sends failures to spam, reject blocks them.
Step 2: Ask Blackbaud the right questions
How Altru’s outbound email can be authenticated for a custom domain is something Blackbaud controls, and the options have changed over time. Rather than guessing, open a support case and ask specifically:
- What return-path domain and sending servers does Altru use for our organization’s email?
- Can Altru email be DKIM-signed with our domain? If so, what DNS records (usually CNAME or TXT) do we need to publish?
- Is there an SPF include you recommend, and will it actually align with our From domain?
- Are there any restrictions on which From addresses we can use?
Bring the headers from Step 1. Showing support the exact authentication results gets you a faster, more specific answer than “our emails are going to spam.”
Step 3: Pick a From address strategy
Depending on what Blackbaud can support, you’ll usually land on one of these:
Your main domain, with DKIM set up
If Altru can sign mail with your domain, IT publishes the DKIM records Blackbaud provides, and DMARC passes through DKIM alignment. This is the cleanest outcome: guests see the address they recognize, and your strict policy stays in place.
A dedicated subdomain
Some organizations send system email from something like tickets@mail.yourmuseum.org. A subdomain can have its own SPF, DKIM, and DMARC records, so you can authenticate Altru mail there without touching the records your staff mailboxes depend on. It also keeps any deliverability problems with ticket or appeal email from bleeding into everyday staff email. Confirm with Blackbaud that the subdomain approach works with how Altru sends before you commit.
A platform address with a Reply-To
If neither of the above is available, the fallback is a From address that the sending platform is authorized to use, with your real address set as the Reply-To so responses still reach your team. Guests see a less familiar sender, which can affect open rates, but the mail gets delivered. Check whether your Altru setup lets you set a separate reply-to; if you’re not sure, test it in a sandbox or ask support.
Step 4: Change DMARC carefully
If IT is still rolling out DMARC, ask them to start at p=none with reporting turned on (the rua= tag). The aggregate reports show every service sending as your domain: Altru, your newsletter tool, your online store, the HR system nobody remembered. Fix alignment for each one, then move to quarantine and eventually reject.
Going straight to reject before every sender is aligned is the most common way a museum’s eTickets and donation receipts silently stop arriving.
Quick answers
Can I just turn DMARC off?
You can loosen it, but major mailbox providers now expect a DMARC record for bulk mail, and a weak policy makes your domain easier to spoof in phishing aimed at your members and donors. Fixing alignment is the better path.
Do I need to change anything inside Altru?
Possibly just the From address on your email templates or communication settings once the DNS work is done. The authentication itself lives in DNS and on Blackbaud’s sending side, not in Altru’s day-to-day screens.
How do I know it worked?
Repeat the Gmail “Show original” test. You want DMARC: PASS, with either SPF or DKIM passing for your own domain. Then keep an eye on your DMARC reports for a few weeks.
