Security updates

Is your system running with the latest security updates?

If you're on WordPress, you should check on that now.

WordPress released a security fix last week that has been causing lots of trouble.

Compromised sites.
New admin users created.
Sites defaced or quietly misused.

If you're on another CMS, it's still worth checking on.

Security updates are not something you want to sleep through.

All the best,

A.

P.S. If you're on Joinery's Operational Assurance plan, you're already covered. If not, check with your tech team to be sure you have a good plan in place.

Thin

The peach tress in my backyard are done producing for the year.
Results are mixed.

For one of them -- but not the other three -- I took the time early in the season to thin the fruit.

Thinning always feels wrong.
I'm literally plucking dozens of tiny peaches and throwing them into the compost.

Part of me always imagines each of them large and sweet and juicy.
Culling them seems a shame.
Maybe I should let them all grow.

But now I wish I'd thinned all four trees.

Because where I thinned, I got fat juicy peaches.
And where I didn't, I just got a bunch of hard tiny fruit.

Sometimes getting the best results means deliberately giving up on perfectly good possibilities
so the ones you keep have room to flourish.

All the best,
A.

The question is worth more than the answer

Ever try to learn a new language?
Or swing dancing?
Or to play an instrument?
Or any system that requires more than a handful of facts to operate?

Could you do it just by quizzing an expert?

Or would you need to spend time trying, rethinking your approach, observing the results, and repeating that hundreds of times?

Of course for that kind of learning, just "asking questions" and "gettting answers" isn't enough.

You have to let your mind spend time in the problem.

Form your own theories about how the whole thing works.

Test those theories; see if they match the real world; and adjust them until they do.

Repeat that process, and you'll get deep learning that goes beyond memorized facts.

Skip it, and you just get whatever it is that comes with quick answers.

All the best,
A.

The message that sticks

Every communication you send contains both an explicit message and an implicit one.

Whether you're training a staff member, reporting to your board, or appealing to your donors.

The explicit message is usually something like:

• Here's our standard procedure.

• Here's a summary of our status, strengths, and weaknesses.

• Here's how your donation helps.

But along with that comes an implict message.

How you handle questions and surprises.
Your reaction to push-back and challenges.
Your choice of analogies, incentives, and priorities.
Your underlying emotional state.

What can be surprising is this:

Long after the explicit message is forgotten, the implicit message sticks -- and pretty deeply, too.

Of course, if you're not careful, you can send a lot of implicit signals that contradict the good things you’re trying to say.

But if you're paying attention, you can communicate a lot of good things implicitly:

• I'm hopeful, and with good reason.

• I care about your interests.

• I think you're valuable, capable, and good.

• I actually believe the things that I’m saying.

Do that often enough, and you'll be building the culture you want to see.

Because culture isn't built only by what you say.

It's built by what people learn while you're saying it.

All the best,

A.

“Chasing the system”

When something unexpected happens in your CRM system, you have two choices.

You can chase the system.
Or, you can try to understand it.

"Chasing the system" is my term for hacking away at things just enough to make them look good.

A report seems wrong?
Change the data until the report looks right.

Someone didn't receive a mailing?
Add them to a different group.

Staff member gets an error?
Give them another permission.

Sometimes it even makes the symptoms go away.

But your understanding doesn't improve.

Do that often enough, and you end up with a system full of mysterious fixes that nobody understands and everybody is afraid to touch.

The alternative feels slower.

Instead of asking, "What should I change?"
Ask, "Why did this happen?"

That one question changes everything.

Every answer makes your mental model a little more accurate.

And over time, that's what makes you effective.

The point isn’t to memorize every setting in the system.

It’s to understand the system well enough that you can predict what it will do before you change it.

All the best,
A.

Delegating or babysitting?

One of the biggest jobs of a manager is delegation.

Because if every decision has to come back to you,
your organization can't really grow.

Of course, effective delegation doesn't begin with delegation.

It begins with onboarding:

• Helping someone understand how you do things.

• Giving them context.

• Teaching them what "good" looks like.

• Answering questions while the stakes are still low.

But it doesn't end there.

It continues through ongoing investment:

• Regular conversations.

• Feedback.

• Encouragement.

• More context as their responsibilities grow.

Skip those investments, and something weird happens.

You still think you're delegating.
But you're probably babysitting.

Every decision comes back to you.
Every task needs reassurance.
Every mistake becomes evidence that "I guess I just have to do it myself."

The funny thing is...

Babysitting often feels cheaper than good onboarding …

Right up until you realize you've been answering the same questions over and over for the past six months.

All the best,
A.

“Explain like I’m 5”

Every organization has things it needs to explain.

To staff.
To volunteers.
To donors.
To the people it serves.

And surprisingly often, one page is enough.

Now and then, a client will ask me to help them work up some "one-pagers" for their staff.

I almost always say yes.

Here's one I made recently for client staff who are testing a new login feature:

Sure, a one-pager isn't as flashy as a 30-minute training video.
It's not as detailed as a 20-page annual report.

But people read it.
If it's well done, they remember it.
And when they need it again, the info is right there.

Here's what I've learned:

It's tempting to try and explain everything.
But people don't usually need a comprehensive explanation.

They just need enough
to understand the idea today
and a quick way
to refresh their memory tomorrow.

Whether you're training staff,
or encouraging donors,
or helping someone reset their passord...

The one question worth asking is not,
"Am I covering all the bases?"
but,
"What do they really need to know?"

Because the goal of communication isn't completeness.

It's understanding.

All the best,
A.

Someone to show up for

We usually think coaching gets us "access to expertise." But it also gets us someting even more important: someone to show up for.

---

Big improvements usually come from consistent effort over time.

The hard part isn't knowing what to do.
It's doing it again next week.
And the week after that.

Something I've noticed in my own life:

The things I do with other people tend to stick.
The things I can do "whenever" are much easier to postpone.

My Brazilian Jiu Jitsu classes happen at scheduled times, with people who expect me to be there.
My strength training plan is completely flexible. If I skip in the morning, I can pick it up in the evening. Maybe.

Guess which one I've been more consistent with,
and made the biggest improvements in.

It's made me think differently about coaching:

Sure, you're getting access to expertise.
But you're also getting accountability.

Because "see you next Tuesday at 3:00" isn't an abstract promise to our future selves.
It's an appointment with another human being.

It doesn't just improve the quality of your effort.
It improves the consistency of your effort.
And that's what matters over time.

Because the opposite of accountability isn't laziness.
It's optionality.

Your gym is always open.
Your great American novel is always waiting.
That side project can always start tomorrow.

A coach changes that.
They convert "I should work on this sometime" into "I'll see you Thursday."

That's a much more profound shift than simply receiving advice.

If you're struggling to make progress on something important,
don't just ask whether you have enough information.
Ask whether you have enough accountability.

Sometimes the missing ingredient isn't a better plan.
It's another person expecting you to show up.

All the best,
A.

It never hurts to ask

1. Burnt bulbs.

So I'm out of town to attend support a client at their annual conference in Florida.

And my wife tells me she got pulled over last night because her license plate lights are out.

Normally, this would be "my area," but this time I'm just not available.

I figure she'll just have to pick up the bulbs herself and wait until I get back to install them.

But nope.

Next day she texts me, "I went to O'Reilly's to buy the bulbs, and he installed them for me."

2. Blocked email:

Last week a coaching client simply couldn’t get outbound email working in CiviCRM.

We looked at it together and verified everything was set as it should be, but no luck.

I suggested he check with his hosting provider to see if there might be something blocking the connection at the server level.

So he reached out to them.
He also asked on the CiviCRM Q&A site, in case anyone else had ideas.

Next day he emailed me, "I contacted the host, and they showed me the setting to change in my hosting control panel." Problem solved.

Here’s the thing:

Everyone needs help sometimes.

And there's never just one place to get help.

CiviCRM StackExchange
CiviCRM Community Chat
CiviCRM Doc Bot
Your hosting provider
Your own CiviCRM advisor

When you can’t figure it out on your own, it never hurts to ask an expert.

All the best,
A.

“Happy to help”

The past few weeks have been a rough time in the lawn-care department at the old Shaw homestead.

A few consecutive rainy weekends…
A busy travel schedule…
Commitments at work and with kids and extended family…

all meant that I had my hands pretty full this past weekend.

But the sun was out, and I was determined to restore that lawn to its former beauty, come hell or high water, as Grandpa used to say.

My daughter was in town.
She said, what are you doing this weekend?
I named about six things, including the neglected lawn.
And she said...

"Come on, let me mow that lawn for you."

Well, okay then.
Bang.
Done.

I offered to pay her.
But she wouldn't have it.
She was just happy to do it.
I was skeptical of that, but it seems to be True.

Here's the thing:

When you're very busy,
it's easy to focus on how busy you are,
and to think that the only way out
is to get busier.

But sometimes,
if you look around,
you'll find there are people
who are happy to help.

Why not let them?

All the best,
A.

It’s not always easy

I went back today and reviewed our participant feedback from the CiviCRM Admin Training in Toronto last month.

Interestingly, almost all of them highlighted something we kind of suspected already:

For such a broad topic as “administering CiviCRM,” it’s hard to find exactly the right balance between “covering everything” and “getting deep on the topics that matter to each participant.”

Even in a two-day course, some folks had questions that we didn’t have time to dig into.

Even in a small group of a dozen-or-so participants, some felt overwhelmed by all the new information, while some others endured explanations of areas they’d already mastered.

Fortunately, everyone got something out of it, and they all reported that it was worth their time and effort to attend.

My take-aways here:

• Group trainings (or generalized documentation) can make it hard to target the precise level of interest and experience of any given individual.

• Even when you’re experienced in one area, mastering new concepts can still be a challenge — there’s always something new to learn, when you’re ready for it.

That’s just the nature of things:
we learn;
we get comfortable;
we get a new idea;
then we need to learn more.

And if we can get the right kind of help at the right time, we usually find it’s worth the effort.

All the best,
Allen

Outbound email delivery: Alphabet soup

Yes, after two previous emails about configuring CiviCRM for outbound email, I’m on my third.

(This really is one of the most overlooked configuration steps among CiviCRM sites.)

So let's talk about three acronyms that most people would rather ignore:

DMARC.
DKIM.
SPF.

Sure, they sound like technical gobbledygook.

The good news is that you don't need to understand the technical details to get this right.

But you do need to get this right -- inbox providers take it very seriously.

When Gmail, Yahoo, Apple, Outlook, and other providers receive a message claiming to be from your organization, they want proof that the message is legitimate.

That's what DMARC, DKIM, and SPF are for.

Think of them as a set of credentials that help verify:
The message really came from your organization.
The message wasn't modified in transit.
The sender is who they claim to be.

If those checks aren't configured correctly, your email will very likely bounce.

Or worse, it will just be silently routed into nothingness -- no one will receive it, and you won't even get a bounce notification.

So, how to configure all this stuff?

Most email delivery services provide step-by-step instructions.
For example, SendGrid's domain authentication wizard will tell you exactly how to set this up.

And once configured, these settings usually require very little ongoing attention.
But it does make a huge difference -- and it does need to be done.

Because in today's email ecosystem, properly authenticated email isn't an advanced optimization.

It's the price of admission.

All the best,
A.

CiviCRM email delivery: The default settings aren't good enough

Besides bounce tracking configuration (covered in yesterday’s email), there's another important step in configuring CiviCRM to ensure your outbound email makes it to your recipients' inboxes:

Using a reputable outbound email service.

Why does this matter?

By default, CiviCRM will try to send emails directly from your server.

That's better than nothing, but it won't be enough to get your email through to most of your recipients.

The problem is that inbox providers have become much stricter about who they trust.

These days, services like Gmail, Yahoo, Apple, and Microsoft expect email to come from systems that follow modern sending standards and maintain a reputation as legitimate senders.

That's where an email delivery service comes in.

Services like SendGrid, Mailgun, Postmark, Amazon SES, and others specialize in getting email delivered reliably.

Instead of sending email directly from your website, CiviCRM hands the message to the delivery service, which takes care of the rest.

For many organizations, the cost is minimal.
For lower volumes, it may even be free.

My usual recommendation is SendGrid paired with CiviCRM's AirMail extension, but there are other good options as well.

Whatever service you choose, don't stop at simply connecting it.

Take the time to follow the provider's setup instructions completely.

Especially the parts about domain authentication and bounce handling.

Because the difference between "email was sent" and "email was delivered" is often larger than people realize.

All the best,
A.

Are your emails bouncing? Would you even know?

One of the most valuable email features in CiviCRM is also one of the most commonly overlooked: bounce tracking.

Every organization accumulates bad email addresses over time.

People change jobs.
Accounts get abandoned.
Domains disappear.

When you send email to those addresses, the messages bounce.

And if you keep sending to addresses that bounce repeatedly, inbox providers will start to think you're acting like a spammer.
And they'll start treating you like one, by bouncing your emails more frequently.

Fortunately, CiviCRM has tools to help.

It can track bounced emails and automatically de-list bad addresses so you don't continue sending to them.

The catch?
You have to configure it.

CiviCRM just doesn't have access to automatically set this up for you.

Here’s a quick test:

Create a CiviCRM scheduled mailing that includes an address you know will bounce.

If that address doesn't appear in the "Mail Bounces" report within a day or so, there's a good chance your bounce handling isn't configured correctly.

That's worth investigating.

Because sending email is only half the job.

Knowing which messages never arrived is just as important.

If you're having trouble with this, I recommend you take a look at the docs here, or reach out to someone who can help you with this.

All the best,
A.

CiviCRM upgrade help: anticipate upgrade messages

Here’s a nice tool that will help you get ready for your next CiviCRM upgrade: CiviCRM Upgrade Message Previewer.

You might want to take a look at it before the next CiviCRM security update, which is scheduled for this week.

How does this make upgrades easier?

Upgrades in CiviCRM will sometimes present you with alert messages that need a little extra thought — and sometimes need a little extra action.

Normally, you won’t see these messages at all until you’re in the middle of an upgrade. That is, after you’ve already loaded the newest CiviCRM code files on your site.

Considering that some of these messages call for additional action on your part, it can help a lot to know what to expect ahead of time, so you can be ready.

How does it work?

Just tell it your current CiviCRM version, the version you’ll be upgrading to, and your CMS (Drupal, WordPress, etc.), and click the button.

You’ll get a full list of the pre-upgrade and post-upgrade messages you can expect to see in that upgrade, including helpful descriptions and links to additional documentation when it’s relevant.

Shouldn’t I see these messages when I upgrade my sandbox site?

Yes! If you’re making the extra effort to upgrade a sandbox copy of your live site first — as a test before actually upgrading you’re live site — that’s great! It’s the recommended practice.

And when you do that, you’ll see these same messages. Since the site is just a sandbox copy and not your actual live site, you’ll have time to react to those messages.

But for folks who still have a hard time building a sandbox copy of their site, that kind of prevew workflow is not an easy option. So a tool like this can really help.

All the best,
A.

AI oversharing, and lame passwords

Have you (or your staff) ever uploaded a spreadsheet from your CRM into Gemini for some quick insights?

Or pasted a long email thread into ChatGPT for a summary?

It's convenient.

Maybe a little too convenient.

Twenty years ago, it was hard to convince people that password security mattered.

"Use strong passwords."
"Use different passwords on different accounts.”
"Never send them by email."

For people who were just trying to get things done, the risks felt abstract.

By now, most of us have heard enough stories of hacked accounts, identity theft, and fraud to understand why those precautions matter.

I think we're in a similar place with AI.

The benefits are obvious.
The risks are harder to see.

But I don't think it will be 20 years -- maybe not even 5 -- before we start hearing real stories that make the risks clearer: major data disclosures, fraud, and other abuses derived from the information people are casually sharing with their AI tools.

Please be careful.

If you wouldn't post that info publicly on social media, think twice before sharing it with an AI vendor.

All the best,
A.

The bad guys are using AI, too

Everybody's excited about AI and the possibilities of represents for productivity and insights.

But guess who else is using it.

Criminals, spammers, and troublemakers, that’s who.

This article from NPR covers lots of detail without getting too technical, but my main take-aways for you are two:

1. This is one more reason to apply security updates for your software in a timely fashion. For example, CiviCRM has a security update coming out next week.

2. Password disclosures and other run-of-the-mill weaknesses are still far more common than AI-powered attacks. So use strong passwords and two-factor authentication, and disable unused accounts.

Here’s the thing:

As long as you've got something the bad guys want -- and you probably do -- security will continue to be an arms race.

Staying ahead of the game is worth the effort.

All the best,
A.

CiviAcademy: quality video tutorials for CiviCRM

Getting new staff into your CRM usually comes with some real challenges in training:

• “There are a ton of features just out of the box; how can we orient them quickly on how it all fits together?”

• “We’ve got our own way of using this CRM; how can we train them in our unique standard procedures?”

For that second one, it may be obvious that documenting your own policies and procedures is a worthwhile endeavor, however tempting it may be to put it off.

After all, if there’s nobody else in the world who does this the way you do, then nobody else can help you train new staff on doing it your way.

But for that first one, you might want to check out CiviAcademy, an ongoing series of training videos published by the creators of CiviCRM.

They describe it as:

Bite-sized tutorials to help you maximize CiviCRM.

Easy to understand video tutorials that will take you from an absolute newbie to a CiviNinja in no time!

... high-level, fast-paced instruction designed for users of CiviCRM ... showcasing major features and common customizations.

It’s a growing library of genuinely well-presented short content.

Honestly, even if you’ve been using CiviCRM for years, I’m willing to be there’s something in there that will improve your understanding.

Finally, a special benefit for my existing clietns:

If you’re already a subscriber to any of my services, and you’d like to use CiviAcademy for your team, please email me about getting a 100% lifetime discount for this resource.

(Since Joinery is a CiviAcademy sponsor, I’m able to offer this to you, no strings attached. I really just think it’s a great resource and want to see more people making use of it.)

All the best,
Allen

Why I don't recommend SparkPost for CiviCRM

If you're sending mass emails from CiviCRM, you really ought to be using a professional SMTP service to handle those outbound emails.

Until recently, I've recommended that my clients consider either SendGrid or SparkPost for this service.

But I can't recommend SparkPost anymore.

They're not evil or incompotent -- nothing like that.

The problem is just that SparkPost isn’t a good fit for any organization that maintains more than one mailing list.

Consider a scenario where your organization lets people sign up for a variety of email lists:

• Legislative Updates

• Monthly Newsletter

• Volunteer Opportunities

CiviCRM is built to allow each person to unsubscribe from any of those lists, while remaining subscribed to others.
That seems pretty reasonable.

Unfortunately, my clients and I have found that SparkPost is not so nuanced.

For each mass email message you send, CiviCRM insists that it offer an “unsubscribe” link of some kind.

But still, SparkPost adds an "unsubscribe" feature of its own.

Unfortunately, if one of your readers uses that feature to unsubscribe from, say "Legislative Updates," SparkPost will treat them as if they've unsubscribed from all possible lists, so they'll also stop receiving the Monthly Newsletter and the Volunteer Opportunities mailings too.

... even though they still appear to be subscribed in CiviCRM.

:-(

Now, I'm sure the intent here was good.

SparkPost surely is trying to prevent the delivery of unwanted emails.
That's an admirable goal.

Unfortunately, the way they're doing it is rather ham-fisted, a sledgehammer in place of a scalpel.

So ...

If you're using SparkPost, and you've been wondering why some people aren't getting your emails, this may be part of the reason.

There are ways to inspect your SparkPost account (under the "Suppression List") to find subscribers who may have been caught up in this.

But even then, there's no way to say for sure whether they really wanted to unsubscribe from everything, or just a single mailing list.

Now I'm down to recommending just one SMTP service: SendGrid.

If you're using another SMTP service (or "ESP", Email Sending Platform), and are having a good experience there, please let me know.

I'd love to hear about it.

Having more options is generally a good thing — as long as they’re good options.

All the best,
Allen

Knowing what matters

Let me ask you ...

Where do you go for information?
Your phone, news feed, social media?

And where do you go for knowledge?
Research, experimentation, measurement?

And where do you go for wisdom?
... well ... ?

Here's a thought:

We're generally drowning in information:
Reports.
Dashboards.
Metrics.
Benchmarks.
News.
Updates.
Events.
Opinions.
Facts.

With a little effort,
we can even distill that down for knowledge.

But for wisdom ... it's different.

Wisdom is knowing what matters.

It's understanding that every choice means giving up something else.
It's recognizing that we rarely get everything we want.
But that we can often get what matters most,
And be content with the trade-offs.

That perspective only comes over time,
through experiences, mistakes, reflection, and care.

You can't download it.
You can't subscribe to it.
You can't generate it on demand.

You have to earn it.

A little at a time.

All the best,
A.