AMO should use a sender of its own domain for outbound emails

bqbn commented 3 months ago

Describe the problem and steps to reproduce it:

Outbound emails from AMO sometimes appear to be sent from domains other than its own. For instance, some outbound emails are observed as originating from nobody@mozilla.org. Meanwhile, AMO uses a different email provider than mozilla.org does for sending emails. This arrangement works because the DMARC policy of mozilla.org is relatively permissive. Presently, the DMARC policy of mozilla.org is as follows:

$ dig +short _dmarc.mozilla.org TXT
"v=DMARC1; p=none; adkim=r; aspf=r; rua=mailto:dmarc_agg@vali.email,mailto:dmarc@mozilla.com"

This situation may lead to email reception issues in the long term.

What happened?

What did you expect to happen?

I propose that we explore the possibility of sending emails using the appropriate domain for each environment. For example, in the staging environment, we could use nobody@addons.allizom.org as the sender, while in production, we would use nobody@addons.mozilla.org.

This approach would enable us to configure distinct DMARC policies for each environment, without being dependent on the DMARC policies established by our parent domain.

Anything else we should know?

As for rollout, we should proceed env by env, ensuring that email sending functions correctly for one env before moving on to the next.

┆Issue is synchronized with this Jira Task

diox commented 3 months ago

See also https://github.com/mozilla/addons/issues/6637. Stealing my comment from that issue, we have the following settings governing what From we use:

ADDONS_EMAIL (or its alias DEFAULT_FROM_EMAIL), which is "Mozilla Add-ons <nobody@mozilla.org>"
NOTIFICATIONS_FROM_EMAIL, which is "notifications@%s" % settings.INBOUND_EMAIL_DOMAIN, where INBOUND_EMAIL_DOMAIN is coming from an env variable (defaults to addons.mozilla.org). In addition the name of the user that triggered the activity message is added before the email.

diox commented 3 months ago

Less of a priority now that DMARC setup has been adjusted to verify our emails as valid in https://mozilla-hub.atlassian.net/browse/IO-2807

Although it's probably a good idea still to move to addons.mozilla.org and make sure we have DMARC setup for that domain as well.

bqbn commented 3 months ago

Yeah, let's wait and see how the new DMARC setup works and then make a decision on this ticket later.

KevinMind commented 2 months ago

Old Jira Ticket: https://mozilla-hub.atlassian.net/browse/ADDSRV-795

mozilla / addons