University of Arizona’s central email systems (UAConnect365 and CatMail) add a notification on emails that come from outside the University of Arizona.
The subject line has [EXT] added to the front of the subject. The body of the email starts with red type cautioning you that the email is from an external source.
Subject: [EXT]
External Email
Why Is This Notification Added?
Phishers often create misleading or spoof addresses to make their email look like it is coming from the University of Arizona. These emails make it more likely that members of the campus community will get infected by malware from a link or attachment, or will fall for a scam involving their personal or financial information.
The External Sender Notification (ESN) provides a line of defense, helping you identify emails from outside the University.
This measure was approved by the University Office of the President, University Marketing & Communications, and Information Security Office to mitigate the impact of spam and phishing emails on campus.
What Should I Do?
Not all external emails are a scam. However, when you see ESN, be wary of:
- Opening attachments
- Clicking on links
- Providing personal information
- Performing financial transactions for the sender
When a sender looks like someone at the University but has the “external” banner, be extra cautious.
You can see current scams received on campus at Phishing Alerts.
Is Email with the ESN Always External?
Some email marked “external” may be from a departmental email system or bulk email account (Constant Contact, MailChimp, etc.) when the department has not coordinated an exception yet.
Some IT services used by the University that generate emails may show the ESN, such as Zoom, Box, Slack, and Office 365 apps like Teams and One Drive.
My Department’s Email is Getting the ESN
If email from your departmental email system or vendor bulk email is getting the ESN, send an email to EmailExceptionRequest@email.arizona.edu to request an exception. Include the following information:
- Requesting Business Unit: (College, Department, Organization, etc.)
- Requesting Point of Contact: Name, Email address, and phone number. (*Should be an individual familiar with the third-party vendor used by unit for mass email communications)
- Name of third-party vendor service or system: (Examples: MailChimp, Constant Contact, MyEmma, EventBrite, RecTrac, Benchmark, etc.)
- Vendor’s Unique Header Name and Value associated with Business unit’s account. (Forward as an attachment a sample email. Ask IT staff for assistance if needed.)
- Business Process it supports: (Examples: Internal communications, external communications, newsletters, fundraising, etc.)
- Audience/Size: (Faulty, Students, Alumni, External Sponsors, etc.)
- Frequency of Use: (Ad hoc, daily, weekly, monthly, etc.)