LabDeck

An internal platform for authoring and running hands-on SRE lab training.

LabDeck is a privately operated training system. Instructors author lab guides, take them through a draft → review → published workflow, and run live classes against individually assigned lab environments. Students work through the guides, complete comprehension checkpoints, and their progress is visible to the proctor running the session.

The platform is operated privately rather than sold as a product. Accounts are created by invitation only — issued site-wide by an administrator, or by the proctor running a class session. There is no public signup. The ability to author, review or proctor is granted separately by an administrator.

Who we email

Every recipient is someone an administrator or a proctor has given an account or enrolled in a class session. Addresses reach us from a member of our staff who already works with that person — never from a public signup form, and never from purchased, rented, scraped or appended lists of any kind.

Two of our messages can be triggered without signing in — a password reset and a re-sent verification link — and both send only to an address that already has an account. A stranger cannot use them to make us mail someone who is not already a user. Both are rate limited by source and by recipient, sending is capped in total per day, and any address that hard bounces or reports a complaint is suppressed and receives nothing further.

Email practices

All mail we send is transactional or relationship mail tied to an account the recipient holds or has been invited to:

Invitations issued by an administrator or a class proctor
Address verification when an invitation is accepted
Password resets
Class session and roster notifications
Reminders to students already enrolled in a lab

That is the whole list. We send no marketing or promotional mail of any kind.

Authentication and feedback handling:

SPF, DKIM and DMARC are published and aligned. Mail is DKIM-signed with our own domain key, and we operate a custom MAIL FROM domain so SPF aligns as well.
DMARC aggregate reports are collected and reviewed at _dmarc.ciscosre.com, and the policy is ratcheted on that evidence rather than left unmonitored.
Bounce and complaint handling is automated. Delivery events are published to a queue and ingested by the application, which maintains its own suppression list — so a hard bounce or a spam complaint stops every further send to that address, at our end, before a message is attempted. Amazon SES's account-level suppression list is a second, independent backstop.
Unsubscribes are honoured immediately by the same list, which also records administrator decisions. An unsubscribe never blocks security mail such as a password reset.
One-click unsubscribe (RFC 8058 List-Unsubscribe-Post) is attached to every bulk message, alongside a visible unsubscribe link. Unsubscribes take effect immediately and never block security mail such as a password reset.
Outbound send rate is limited by the application, both overall and per individual recipient.

What our mail actually looks like

A real example — a roster notification, which is the only kind of mail we send that carries an unsubscribe, reproduced from the template the application uses:

From LabDeck <noreply@ciscosre.com>
Reply-To postmaster@ciscosre.com
To student@example.com
Subject Added to session: SRE Fundamentals — March cohort

You've been added to the session SRE Fundamentals — March cohort.

It runs on 12 March 2026, 09:00–17:00 UTC.

Open it here: https://labdeck.ciscosre.com/sessions/…/live

You received this because you are on a LabDeck session roster. Unsubscribe from session notifications. Account mail (sign-in, verification) is not affected.

Every message of this kind also carries the one-click unsubscribe headers, so a mail client can offer its own unsubscribe button without the recipient opening the message:

List-Unsubscribe <https://labdeck.ciscosre.com/api/mail/unsubscribe?t=…>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Account mail — an invitation, an address-verification link, a password reset — carries no unsubscribe footer, because opting out of your own verification link is not a coherent request. Those messages are sent only in response to something the recipient or their administrator just did.

Contact

General and technical: postmaster@ciscosre.com
Abuse reports: abuse@ciscosre.com

Both addresses are monitored. If you received mail from this domain that you did not expect, please write to abuse@ciscosre.com and we will investigate.