I am on a team building a SAAS application. Part of the application will send out scheduled reminders to our customer's clients. The project description is asking for the ability for our app to send out those reminder emails using an email address of the customer's choice, preferably their own domain, essentially spoofing the email "From" address.
Our customers would be businesses using our service to send out reminders "on their behalf" to their companies clients. The expectation is that they would want their clients to think they were sending out the reminders themselves, and not "farming out" the responsibility to a third party. So they would likely want our service to be as invisible as possible. This is in fact how reply.io, grade.us and several others work. They ask you to fill out details and include what email address you want the email to appear as coming from.
I immediately balked at this idea having been in charge of a mailing list software and dealt with the fallout back in 2014 with Yahoo and their DMARC policy snafu.
But it was pointed out to me that many other services, like reply.io for instance, do this with their customers. So I tested the email reminders they send out and found that they pass DKIM but Softfail on SPF and Fail on DMARC. However the emails they send still seem to be getting through ok, having tested sending to Gmail, AOl, & Yahoo. Those services do mention that you should not use a "free email address like Gmail, Yahoo, etc" as the "From" email because that will cause emails to be rejected.
They of course all have the typical message...
...google.com does not designate 2607:f8b0:400e:c00::233 as permitted sender
But they also have for the SPF
...the domain somedomain.com reports 18.104.22.168 should not be sending mail using it's domain name, but is not forbidden from doing so
So having dealt recently with a reconfiguration problem on a server where the SMTP reverse DNS lookup was failing along with both DMARC and SPF and that was causing emails to be immediately rejected from AOL and Yahoo, I am not totally clear on how these services can reliably get mail through.
Is failing SPF and DMARC not really that bad? I feel like choosing to straight up spoof email in this way is going to have other consequences down the road.
Some services, such as reviewtrackers.com, are using sendgrid which works hard on reliability, seem to avoid this practice. Emails from them come through like
MY Name <email@example.com> via sendgrid.info and the email shows as being mailed by
email.reviewtrackers.com and being signed by
This latter method would seem to me to be more transparent and reliable, but a director in our project thinks that it might cause the email to appear not as personal or ignored because some may notice it is from a third party.
Mainly I am really wanting to know if spoofing emails and just ignoring the fact that DMARC is going to fail is really considered a legitimate practice, and how it might come back to haunt us.