Out-of-Office messages to external contacts
Up until recently, it hasn’t been possible to
set your Out of Office assistant in Outlook to notify external
contacts that you are unavailable. We can now enable this provision
for staff who specifically request it.
Use of the Out of Office assistant for
external messages isn’t without risks and we urge staff to read the
following guidelines prior to requesting this provision. Use of the
external out of office assistant presumes that you agree to use it
in a responsible way and accept the likelihood that you will
receive more spam mail than previously, as a result.
In all cases, we will only enable the Out of
Office external function once we have received confirmation from a
member of staff’s line manager that this function is essential to
business continuity and that the risks have been fully
understood. The Line Manager making this request will be
accountable for ensuring the function is used appropriately.
We would ALWAYS recommend the use of a
resource mailbox which several staff have access to (such as
rather than an individual having to resort to using the external
Out of Office function. We do appreciate however that in some cases
there is only one individual who could respond and the Out of
Office function is essential in advising any contacts that they
won’t receive an immediate response. We agree that all people
contacting the University should receive a prompt and proper
response. Please consider carefully whether an Out of Office
message is the most appropriate way for you to do this.
If you would like us to enable this provision
on your account then please ask your Line Manager to contact the IT
helpdesk, requesting this.
Please note, even with this provision enabled
you can set your out of office replies to just go to internal
contacts. You should use the external function only where there is
a clear benefit that outweighs the risks involved (if for example,
you are only away for a day you may prefer for a colleague to have
delegate access to your mailbox, or use a resource mailbox which
other staff can access in your absence).
Overview of Risks
Risk to you and your
It is possible that your out of office message
will go to an unknown person with insincere intentions. If you are
likely to be away from home for a period it would be prudent to
keep this information out of your message.
Risks to the University, its IT
systems and your data
An Out of Office response confirms to anyone
contacting you that this is a genuine email address. You are then
at greater risk of receiving Spam and will have to be especially
vigilant not to reveal your password details under any
circumstance. Once your account has been compromised there is a
risk that your account can be utilised to generate spam mail. This
can result in all email addresses ending in @yorksj.ac.uk being
blacklisted by mail providers such as Hotmail and can cause
significant disruption to University communications with potential
If you subscribe to any mailing lists (such as
JISCmail) and fail to unsubscribe prior to setting an external Out
of Office notification, your Out of Office response will be sent to
all members of that list. Again, this can be considered as
unsolicited Spam and you may find yourself (and potentially the
whole University) blacklisted from these.
If you do receive an email that is clearly
- Delete it and forget it –
never reply to it
- The most dangerous spam emails
are those asking you to click on a link to unsubscribe – never do
that, just delete it.
Guidelines on Use of Out of Office notifications to external
- Only use an external Out of
Office message where the use of a resource mailbox or allowing
temporary delegate access to a colleague will not suffice.
- Once we have enabled the
external OoO function, you must still select on each occasion you
apply it whether or not you wish the OoO message to go to all
contacts or just internally. Always select internally only unless
there is a clear business benefit to the message going externally
- Always unsubscribe from
mailing lists before applying the OoO external message.
- It may seem a little
alarmist but there have been reports that those with a criminal
intent may send messages to an institution so that they can find
out who isn’t there. They can then use this information to break
into homes or offices. This is a fairly rare occurrence, but we
would advise those using out-of-office not to indicate where they
will be. Messages should be simple and to the point. We recommend
text as follows:
- I shall be out of the office
until 20th May 2012; if your communication is urgent, please
contact a Colleague by E: email@example.com or phone ext
If you have any questions or would like
further guidance on the risks involved in using this function,
please contact E: firstname.lastname@example.org
Enabling it on your mailbox
Once the External Out of Office functionality has been added to
your mailbox you will need to enable this manually from within
the Automatic Replies section of Outlook or OWA.
It is possible to configure seperate replies for each -
one that internal users will receive and one for external