Currently when Jira and Confluence Cloud send emails via notifications or automation, in the header of the email there is an entry used for security called "mailfrom". Currently this entry is set to smtp.mailfrom=jira@mail-us.atlassian.net as can be seen in the authentication results section of the email header below:
Authentication-Results-Original: esa.hc463-99.ca.iphmx.com; spf=Pass
smtp.mailfrom=jira@mail-us.atlassian.net; dkim=pass (signature verified)
header.i=@mail-us.atlassian.net; dmarc=pass (p=reject dis=none)
d=atlassian.net
This is true even though the "From:" address is set to something like jira@tenantname.atlassian.net.
NOTE that the "From:" address is independent of the "smtp.mailfrom" address.
In Exchange, if it were coming from a trusted mailfrom address there will be a banner like this on the email:
The way things are now, the banner would indicate that the source is not trusted.
This request is to have the SMTP mailfrom domain set to the tenant domain itself i.e. smtp.mailfrom=jira@tenantname.atlasssian.net OR smtp.mailfrom=tenantname@mail-us.atlasssian.net so that from a security perspective these messages can be trusted and not spoofed from other tenants.
