5

I have been trying to set up DMARC policy, for my domain. The mail is currently being used with amazon-ses, freshsales, and other related apps.

I was successfully able to test it across, with dmarc policy set to p=none. Now, moving further I want to update this DMARC policy to p=reject.

I haven't seen any mail getting dropped from SES, Gmail, etc.

But when I create a calendar invite and make some changes, the mail doesn't get delivered. The same happens with google forms and I guess it is the same across other Google Apps.

I have referred to https://dmarcian.com/google-calendar-invites-dmarc/ and other places but they don't talk about the solution. I could not find the solution in other places, including StackOverflow.

When I diagnosed, I found out the emails from the calendar or forms are generated from the google server, and that is why they are getting blocked. But what can be the solution or workaround?

I am attaching the DMARC and SPF policies set up with my Domain.

Name TTL Type Value
_dmarc 1 hour TXT v=DMARC1; p=reject; rua=mailto:mail@mydomain.com;
@ 1 hour TXT v=spf1 include:_spf.freshsales.io include:amazonses.com include:_spf.google.com include:mxroute.com ~all

I would like to know

  1. How to set up these policies for Gmail Apps like calendars, forms etc? I do not want any of my emails getting dropped due to DMARC policy.
  2. Do I need to set up at Google WorkSpace level, or only set up with Domain Provider will do the job? If yes then how to set up at Google WorkSpace.

Note: These settings work well for any other emails. Only getting blocked for Emails generated from Google Apps. Like, you can create the calendar, but can't send updates from the calendar.

Aditya Raman
  • 90
  • 8

2 Answers2

4

At the moment, this cannot be done.

AFAIU, Google needs to update its tools to use the customer's domain in the return path of emails to solve this issue.

Javier
  • 2,752
  • 15
  • 30
0

Currently there is still no way to change the Envelope From for Google apps. And it is unlikely that this will change, because Google uses the return path for bounce handling, and using your Google Workspace domain could be tricky. Without such option, SPF may pass but it won't match the "From" domain, which is needed for DMARC to pass.

However you can make DMARC pass by setting up and enabling DKIM. SPF still won't be in alignment, but DKIM will, which is enough for DMARC to pass. Just make sure that you set up DKIM and enable signing (aka. "start authentication"). It seems that this second step is often missed, which makes Google Calendar invitation replies to fail DMARC. This often pass unnoticed because Gmail works fine without it (the article explains why).

fvsdpl
  • 1
  • 3