1

I am on a team building a SAAS application. Part of the application will send out scheduled reminders to our customer's clients. The project description is asking for the ability for our app to send out those reminder emails using an email address of the customer's choice, preferably their own domain, essentially spoofing the email "From" address.

Our customers would be businesses using our service to send out reminders "on their behalf" to their companies clients. The expectation is that they would want their clients to think they were sending out the reminders themselves, and not "farming out" the responsibility to a third party. So they would likely want our service to be as invisible as possible. This is in fact how reply.io, grade.us and several others work. They ask you to fill out details and include what email address you want the email to appear as coming from.

I immediately balked at this idea having been in charge of a mailing list software and dealt with the fallout back in 2014 with Yahoo and their DMARC policy snafu.

But it was pointed out to me that many other services, like reply.io for instance, do this with their customers. So I tested the email reminders they send out and found that they pass DKIM but Softfail on SPF and Fail on DMARC. However the emails they send still seem to be getting through ok, having tested sending to Gmail, AOl, & Yahoo. Those services do mention that you should not use a "free email address like Gmail, Yahoo, etc" as the "From" email because that will cause emails to be rejected.

They of course all have the typical message...

...google.com does not designate 2607:f8b0:400e:c00::233 as permitted sender

But they also have for the SPF

...the domain somedomain.com reports 74.125.83.42 should not be sending mail 
using it's domain name, but is not forbidden from doing so

So having dealt recently with a reconfiguration problem on a server where the SMTP reverse DNS lookup was failing along with both DMARC and SPF and that was causing emails to be immediately rejected from AOL and Yahoo, I am not totally clear on how these services can reliably get mail through.

Is failing SPF and DMARC not really that bad? I feel like choosing to straight up spoof email in this way is going to have other consequences down the road.

Some services, such as reviewtrackers.com, are using sendgrid which works hard on reliability, seem to avoid this practice. Emails from them come through like MY Name <myemail@mydomain.com> via sendgrid.info and the email shows as being mailed by email.reviewtrackers.com and being signed by sendgrid.info

This latter method would seem to me to be more transparent and reliable, but a director in our project thinks that it might cause the email to appear not as personal or ignored because some may notice it is from a third party.

Mainly I am really wanting to know if spoofing emails and just ignoring the fact that DMARC is going to fail is really considered a legitimate practice, and how it might come back to haunt us.

  • Are you sure that reply.io allows me to send email in such a way to make it look like it is coming from the company to whom I am sending it? I'm reading their web page, and I don't see anything there that suggests this as a possibility. In fact, I don't see anything there that even says I can send email that looks like it came directly from me. For all I know, they provide a return address on the reply.io domain, which is how most companies like this work. – Robert Harvey Jul 29 '17 at 16:32
  • 1
    In any event, my naive suggestion is to find a way for their own email server to send the emails at your behest. Note that reply.io is not entirely online; they provide a native executable that allows their clients to harvest email addresses from their own servers. – Robert Harvey Jul 29 '17 at 16:44
  • Thanks Robert. Please see my edit for clarification above, and / or my comment to the answer below. Your suggestion to work with their own mail server has been considered. – skribe Jul 29 '17 at 17:48
  • If you've already tried out reply.io and have all of their email headers and know that it works, what prevents you from using their header arrangement, testing it out first to make sure that it works for you? reply.io's practices apparently haven't sunk them yet. – Robert Harvey Jul 29 '17 at 18:51
  • Note that, when I tried reply.io, it asked me for the email account that I wanted to use to send email from, suggesting that the client supplies the equipment (so to speak), not reply.io. (I was required to provide certain permissions to my gmail account, like sending mail on my behalf). – Robert Harvey Jul 29 '17 at 18:54
1

Plain and simple: Using my domain address as the sender for mail you send me will get you rejected. This is commonly done by spammers, and rarely done by legitimate sender, especially in a corporate sending. As reflect in DMARC, SPF, our mail server configuration and published Email Policy, only our servers are permitted to send email claiming to originate from our domain. If you don't want to be treated like a spammer, don't act like one.

GMail, Yahoo, and AOL have a large number of users that send mail directly from their laptops, or other devices using their freemail account as the sender. Their policies are somewhat lenient in this respect. Do NOT rely on freemail services to determine whether mail will get rejected.

I have seen reports that sending email into these services is getting increasingly difficult for senders who do not follow established standards and conventions.

DMARC includes delivery policies which are entirely advisory and includes the action none to be taken with failing message. It is the receiving domain's choice on what to do with messages that fail validation. They may not enforce the requested policy.

SPF failures for legitimate senders are unfortunately far to common. Many MX servers will accept email that fails SPF, although the mail may be filed or flagged as SPAM. On our servers SPF failures will introduce a significant delay until you are able to successfully send the message.

Many sending email servers are listed on public whitelists, which may allow the to bypass some of the checks above. Which whitelists, if any, are used is the receiving administrators choice. The administrator will also choose which if any standards and conventions can be ignored by whitelisted servers.

I would recommend using a noreply address such as "noreply@example.com" as the envelope sender. The address in the from header should be something like:

"Your Reminder Service" <noreply@example.com> 

The "noreply@example.com" address should validate as a recipient. It is common to bit bucket incoming mail to noreply. It is good practice to parse incoming bounce messages to identify which addresses are bouncing. You should stop sending to addresses which are permanently rejected, as well as those that have not accepted mail for a significant period. (There may be legal requirements to do so.)

  • Perhaps my question was not clear enough, but it us sending reminders on behalf of our users to their own clients. So ACME services wants our service to send reminders to their clients on their behalf, and wants us to be invisible in the process. i.e they want their customers to think their email came from ACME personally. – skribe Jul 29 '17 at 16:04
  • @skribe there is no way to guarantee that the e-mail will travel straight from your system to the recipient's so any system in the middle (mailwasher, border gateway, third party whatever analyzer) can act on the rules and reject the message. moreover they can tag you as a spammer and spread the word. – Paolo Jul 29 '17 at 20:12
  • Even when run on a customers systems, I would recommend a noreply address using the customers domain. And yes, there is no way to ensure delivery. Only ways to make successful delivery more likely. – BillThor Jul 30 '17 at 2:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.