Find out what you can do to make sure that emails from Workplace reach inboxes safely. Visit the Customer Resource Center for more information on email delivery.
Emails that are sent by Workplace will originate from the domain fbworkmail.com.
Your email administrator must add fbworkmail.com as a safe sender to your email host, otherwise people in your organization won't be able to receive claim account emails and won't be able to join your Workplace community.
Your email administrator must allowlist these email origin servers' IP addresses to ensure that your organization doesn't reject Workplace emails:
188.8.131.52/25 (184.108.40.206 - 220.127.116.11)
18.104.22.168/25 (22.214.171.124 - 126.96.36.199)
188.8.131.52/25 (184.108.40.206 - 220.127.116.11)
18.104.22.168/25 (22.214.171.124 - 126.96.36.199)
188.8.131.52/25 (184.108.40.206 - 220.127.116.11)
Verifying Email Origin
To prove that emails coming from fbworkmail.com actually originate from Facebook, Workplace uses the industry standard technology DomainKeys Identified Mail (DKIM).Your email administrator should configure your mail host to verify the DKIM record of all Workplace emails to ensure that you don't accept spoofed emails.
To keep Workplace emails from being lost in Microsoft Outlook Clutter, use the PowerShell Exchange Online Commandlet to create two transport rules:
> New-TransportRule -Name "Workplace Emails Bypass Focused Inbox" -SenderDomainIs "fbworkmail.com" -SetHeaderName "X-MS-Exchange-Organization-BypassFocusedInbox" -SetHeaderValue "true" -Comments "Workplace email will go into the Inbox or Focused Inbox and not the Clutter or Other folder in Exchange Online"
> New-TransportRule -Name "Workplace Emails Bypass Clutter" -SenderDomainIs "fbworkmail.com" -SetHeaderName "X-MS-Exchange-Organization-BypassClutter" -SetHeaderValue "true" -Comments "Workplace mail will go into the Inbox or Focused Inbox and not the Other view in Exchange Online"
With Microsoft Exchange, you can allowlist the Workplace email domain using the Set-MailboxJunkEmailConfiguration cmdlet.
This article is only applicable to users of Workplace Essential and Workplace Advanced.
Even if your mail host accepts emails from Workplace, it's still possible that email clients like Microsoft Outlook will mark an email as spam or junk. In that particular case, a person would have to check their spam or junk folders to locate the email. If possible, your email administrator should ensure email clients add fbworkmail.com to their safe senders list.We suggest you work with your email administrator to add the fbworkmail.com domain to a safe senders list in your organization's email client.
When you allow list an email domain on Workplace, you prove that you have access to the email you want to use and allow other people with the same email domain to join your Workplace. People with the same email domain don’t have to join the same Workplace, and are able set up or join different Workplaces with the same domain. This can be used when you don’t own the entire domain.
You can also join multiple Workplaces with the same email domain. There is no limit to the amount of Workplaces an email domain or company can have.
Learn how to allow list your domain on Workplace.
You'll need to adjust your DKIM and SPF configuration correctly to ensure mail servers can verify it was you who sent the emails.
Workplace requires that all email replies be sent with DKIM (DomainKeys Identified Mail) or SPF (Sender Policy Framework) alignment. These are industry email security standards that help verify a sender's details, thereby protecting employees from spoof emails. Emails failing these checks are often treated as spam.
To configure DKIM and SPF, please contact your IT administrator with the below information:
Configuration of DKIM and SPF depends on your email server, and your domain's DNS provider. You must have either DKIM or SPF alignment; you can't have both.
For G Suite, follow this guide.
Note that G Suite defaults to its own DKIM signing domain. As this default action will fail DKIM alignment, since the mail isn't signed by your domain, but by a third-party domain, we will still reject your incoming emails. Therefore, you must configure your own DKIM set up.
For Microsoft Office 365, follow this guide.
Learn more about these security standards.
Note: If DKIM and SPF aren't configured correctly, Workplace will reject messages you send for group activity, for example, group posts or comment replies. In the event that this happens, the sender will receive a bounce message, either from Workplace or from other services including Gmail.