Currently NWEA does not have SFP records for its domains. This allows any SMTP server to say they are from NWEA when they are not. SFP records state to the world which SMPT servers are allowed to email on your behalf. Currently the entire world is able to email on your behalf because you don't have SFP records defined in your domain. I can not whitelist any domain to be allowed into our network if anyone can spoof who it is coming from. Please add needed SFP records to all you domains so we can trust emails are coming from you and only you. https://mxtoolbox.com/SuperTool.aspx?action=spf%3aauth.nwea.org&run=toolpage# shows me you do not have an SFP record for the new email domain you are sending from (auth.nwea.org). I'm not sure what other domains you want us to whitelist but they also require an SFP record. https://connection.nwea.org/s/nwea-news/upcoming-email-domain-change-for-central-login-notifications-MCHOP3HWTORVBBXB4FWZ6X5QGMK4?language=en_US&mkt_tok=OTc2LUlZSS02OTQAAAGbIXT5HoKIILSya7zH9f16o4U4_VAlLeeuaHOC2toUuAo_gSXUFtiDuNqm_Q6O-hAKliQXUpyLVJR7HQzOgFsEZnHhpV6i6cgNKoVIWY_a9G5iDUWx