Parties
Identify full legal names and contact points for the sender, recipient organization, and any relay or ESP. Include role descriptions and escalation contacts to avoid ambiguity in operational incidents.
A clear Business SMTP Document limits security and deliverability gaps, sets responsibility for authentication and encryption, and preserves evidence of authorization. When executed electronically under ESIGN and UETA principles, it provides a reproducible record of consent, attribution, and retention for business and regulatory review.
Use this document when coordinating email sending with vendors, cloud services, or shared-mail platforms; it helps IT, security, and legal teams align on configuration and control.
Completed and signed records reduce misconfiguration risk, support incident response, and document consent for third-party senders.
Identify full legal names and contact points for the sender, recipient organization, and any relay or ESP. Include role descriptions and escalation contacts to avoid ambiguity in operational incidents.
Define which domains, subdomains, and IP ranges are covered; list permitted message types (transactional, marketing) and excluded categories. Precise scope prevents unauthorized or high-risk sending activity.
Record explicit DNS and SMTP requirements: SPF records, DKIM selectors, DKIM key rotation policy, DMARC policy target, TLS minimums, and required port and authentication mechanisms.
Specify credential handling, storage encryption, access control, multi-factor requirements, breach notification timelines, and whether the provider is subject to a Business Associate Agreement (BAA) for PHI.
Set measurable SLAs for throughput, latency, failure response time, and scheduled maintenance windows; include acceptance testing steps and rollback procedures.
Include indemnity, liability limits, data processing terms, audit rights, termination conditions, and signature blocks with effective dates to make the authorization enforceable.
| Field | Configuration |
|---|---|
| Signer Order | IT → Security → Legal → Executive |
| Authentication | Email link; add SMS or KBA for higher assurance |
| Conditional Fields | Show BAA clause only when PHI or HIPAA relevant |
| Audit Trail | Capture IP, timestamp, and completed certificate |
Choose delivery methods that preserve integrity and provide an audit trail for subsequent reviews or disputes.
Ensure the chosen channels support required authentication, retention, and export formats for legal and operational needs.
3–7 business days for technical and legal review
24–72 hours after DNS updates
2–10 business days depending on complexity
Set after validation and agreed rollback window
Annually or on major team changes
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | Yes, 7-day free trial | Varies by plan | Varies by plan | Varies by plan | Varies by plan |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |