ĀYŌDÈ Whitelisting Instructions for District IT

Purpose

ĀYŌDÈ (CoderMerlin Academy) requires access to specific web domains and email addresses for full functionality. To ensure reliable access within your district’s network environment, we recommend adding our domains to your firewall allow lists and our email addresses to your safe senders list.

This document provides all the technical details your IT team needs to whitelist ĀYŌDÈ for web access and email delivery.

Our Commitment to Security

ĀYŌDÈ follows industry best practices to protect student and educator data:

Infrastructure Security

• Hosted on Amazon Web Services (AWS), which maintains SOC 2, ISO 27001, and FedRAMP certifications
• All data encrypted in transit using TLS 1.2+
• All data encrypted at rest using AES-256

Authentication Security

• Identity management through AWS Cognito with secure token handling
• Support for federated authentication (Google Sign-In) using OAuth 2.0 / OpenID Connect
• Role-based access control (RBAC) with realm-based multi-tenancy

Email Security

• SPF (Sender Policy Framework) to prevent sender address forgery
• DKIM (DomainKeys Identified Mail) for message integrity verification
• DMARC (Domain-based Message Authentication) with quarantine policy for failed messages
• Transactional emails only; no marketing or promotional content

Web Access Domains

Primary Application Domains

Allow HTTPS (port 443) access to the following domains:

AWS Service Domains

The application uses Amazon Web Services for authentication and file storage:

Third-Party Authentication

If your district uses Google Sign-In:

Simplified Domain Configuration

For easier firewall management, allow these domain patterns and exact domains:

• *.codermerlin.academy
• setyourvector.org
• *.setyourvector.org
• *.amazoncognito.com
• *.s3.us-east-2.amazonaws.com

Email Whitelisting

Approved Sender Addresses

Add the following addresses to your safe senders or allowed senders list:

Email Sending Domains

Allow emails from these domains:

• codermerlin.academy (primary domain)
• outbound.codermerlin.academy (MAIL FROM domain)

Email Service Provider

ĀYŌDÈ uses Amazon Simple Email Service (SES) for transactional email delivery. All outbound emails are authenticated using SPF, DKIM, and DMARC.

Email Authentication Records

These records can be used to verify the authenticity of ĀYŌDÈ emails:

SPF Record (codermerlin.academy)

v=spf1 include:amazonses.com ~all

SPF Record (outbound.codermerlin.academy)

v=spf1 include:amazonses.com ~all

DKIM

DKIM is enabled and managed by Amazon SES. Emails are signed with rotating keys under the _domainkey.codermerlin.academy subdomain.

DMARC

v=DMARC1; p=quarantine; rua=mailto:support@codermerlin.academy

Sending IP Addresses

Amazon SES uses a shared IP pool for sending. Rather than whitelisting specific IP addresses, we recommend allowing emails based on domain and SPF authentication.

If your security policy requires IP-based filtering, allow the Amazon SES IP ranges for the us-east-2 region. These ranges are published in the AWS IP address ranges JSON file under the AMAZON_SES service.

Platform-Specific Instructions

Microsoft 365 / Exchange Online

Email:

1. Add @codermerlin.academy to Allowed Domains or Safe Senders in Exchange Admin Center
2. Create a mail flow rule to bypass spam filtering for emails from codermerlin.academy

Web (if using Defender for Endpoint):

1. Add *.codermerlin.academy, setyourvector.org, and *.setyourvector.org to allowed URLs
2. Add *.amazoncognito.com and *.s3.us-east-2.amazonaws.com for authentication and file transfers

Google Workspace / Gmail

Email:

1. Add codermerlin.academy under Approved Senders in Admin Console
2. Configure Email allowlist to include the domain

Web (if using Chrome Enterprise):

1. Add *.codermerlin.academy, setyourvector.org, and *.setyourvector.org to the URL allowlist policy

Email Security Gateways (Barracuda, Proofpoint, Mimecast)

1. Add codermerlin.academy to your Allowed Domains list
2. Add outbound.codermerlin.academy to your Allowed Domains list
3. Mark ĀYŌDÈ / CoderMerlin as an allowed SaaS vendor for transactional email
4. Ensure SPF and DKIM validation passes for allowed domains

Web Content Filters (Lightspeed, GoGuardian, Securly)

1. Add *.codermerlin.academy, setyourvector.org, and *.setyourvector.org to the allowed list
2. Categorize as “Education” or “Educational Technology”
3. Add *.amazoncognito.com and *.s3.us-east-2.amazonaws.com for authentication and file transfers

Expected Email Types

Our addresses send only transactional messages:

• One-time verification codes for login
• Password reset emails
• Essential account notifications

We do not send marketing or promotional emails from these addresses.

Contact and Testing

After completing your whitelist configuration, contact us to verify access:

We can send a test verification email and confirm web access is working correctly for your district.

Document version: Draft v0.5