Configuring Oracle Cloud Email Delivery Service

Oracle Cloud Infrastructure (OCI) Email Delivery is a highly reliable, secure, and scalable solution designed for sending high-volume, transactional emails such as notifications, password resets, and application-generated alerts. Properly configuring this service ensures high deliverability rates and protects your domain reputation.

This step-by-step guide walks you through the entire setup process, from configuring Identity and Access Management (IAM) permissions to establishing essential domain authentication records like SPF and DKIM.

1. Create a Dedicated IAM User

To securely access the SMTP endpoint, you must first create a dedicated service user in your OCI tenancy.

1. In the OCI Console, navigate to Identity & Security > Users.
2. Click Create User.
3. Enter a name and description (e.g., smtp_email_user), then click Create.

2. Create an IAM Group

Organizing your service users into groups allows you to manage security permissions efficiently using OCI Policies.

1. Go to Identity & Security > Groups.
2. Click Create Group.
3. Provide a name and description.
4. Add the previously created user to this group under Group Members.

3. Set Up the Policies

Navigate to Identity & Security > Policies, and create a new policy in your root compartment or the specific compartment you are working in.

Use the following policy statements (replace placeholders accordingly):

Allow group '<identity domain name>'/'<group name>' to use email-family in compartment <compartment name>
Allow group '<identity domain name>'/'<group name>' to manage credentials in compartment <compartment name> where target.credential.type = 'smtp'
Allow group '<identity domain name>'/'<group name>' to manage email-family in compartment <compartment name>
Allow group '<identity domain name>'/'<group name>' to manage suppressions in tenancy
Allow group '<identity domain name>'/'<group name>' to manage log-groups in compartment <compartment name>
Allow group '<identity domain name>'/'<group name>' to read log-content in compartment <compartment name>

These permissions are required for managing Email Delivery, SMTP credentials, suppression lists, and related diagnostic logging.

4. Generate SMTP Credentials

OCI Email Delivery requires specific SMTP credentials generated on behalf of your IAM user to authenticate outgoing mail.

1. Go to the User Details page for your created user.
2. Click SMTP Credentials > Generate SMTP Credentials.
3. Enter a description and click Generate.
4. Save the SMTP username and password securely. You will use these credentials for authentication in your application, CMS, or email client.

5. Create DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to your emails, verifying that the email was indeed sent and authorized by the owner of that domain.

1. Go to Email Delivery > DKIM.
2. Click Create DKIM Key.
3. Select the domain associated with your approved sender.
4. Use the following format for the DKIM selector:

oracle-ap-mumbai-1-20250410

5. Add the provided CNAME records to your domain’s DNS zone file as instructed by the console.

6. Create an Approved Sender

For security reasons, OCI will only deliver mail sent from verified addresses associated with your account.

1. Navigate to Email Delivery > Approved Senders.
2. Click Create Approved Sender.
3. Enter the email address you wish to send from (e.g., noreply@yourdomain.com).
4. Choose the appropriate compartment and click Create.

7. Create an SPF Record

Sender Policy Framework (SPF) helps prevent spoofing by listing the authorized OCI IP ranges allowed to send mail on behalf of your domain.

1. In Approved Senders, click the three-dot menu (⋮) next to your sender.
2. Click View SPF.
3. Choose the appropriate record type (typically TXT).
4. Add the recommended SPF record to your domain’s public DNS configuration.

By completing these steps, you have successfully configured Oracle Cloud Infrastructure Email Delivery with proper security policies, SMTP credentials, and essential SPF/DKIM DNS validations. This configuration ensures optimal deliverability and helps protect your brand’s email reputation across major mail providers.