Google in SPF

[rgaudin]

Due to @Popolechien's use of Google Calendar with his @kiwix.org Google account, I had to add Google's SPF include. We are now at exactly 10 queries and have no margin.

The main problem is that we are now allowing Google to send emails on behalf of Kiwix.

• @Popolechien has a Gmail-less Google account with login xxxx@kiwix.org.
• Google Calendar is a free service for Google account owners.
• Google Calendar sends invitations to Event invitees via email using the account name as From:. It's not configurable.
• Google Calendar exists both for Google accounts owners with or without Gmail and for Google Workspace customers (a paying service that's tied to a domain name)
• Google Workspace allows using DKIM for Google-sent emails. In this case, your workspace gets a unique DKIM key that you set on your DNS records. Non-google-workspace cant
• DMARC can only be validated (alignment) if either SPF or DKIM passes
• Without DKIM available, only option is to use SPF.
• Allowing Google SPF means Google can send any email with an @kiwix.org From and will pass.
• It incidentally allows Gmail users with @kiwix.org emails redirecting to their gmail box to send email from their @kiwix.org
• Gmail UI doesn't allow anyone to impersonate an @kiwix.org address. To add such a sender, the user must confirm he owns the mailbox by receiving a code to it.

What should we do with this? It takes 4 queries on our SPF and allows a GAFAM to send emails on our behalf.

While there are alternative services, including one from GANDI, and that Import/Export of calendars is standard the blocking point is probably that GCalendar has a single-button integration of Google Meets in the Event form. And I'm sure there are other unique features of this tool, in addition to habits.

[kelson42]

if i get right: everething works fine now and this is the most important.

That said I'm not happy to have anyone with a @kiwix.org address using google mail/calendar. Using them violates basic privacy requirements for both kiwix and people we write to and write to us. This should be banned.

[rgaudin]

if i get right: everething works fine now and this is the most important.

That's right

[kelson42]

Sooner or later we will have a problem here, probably at the time the CMS will be fully in production.

what we have for alternative are AFAIK:

• We replace the google calendar by a serive of us
• We use a SPF flatener
• Any other?