We don't generally add third-parties to our SPF or DKIM records (there is one exception, with a long and complicated history). Among other concerns, this allows these third-parties to impersonate accounts on our domain, which is a pretty bad idea: even if the legal agreement is ironclad, we're still effectively relying on their security for our own security, and vendor security can vary a lot.

The alternative we usually propose is to either use a subdomain for this purpose (something.wikimedia.org) or a completely separate domain, and then set up SPF/DKIM/DMARC for these.

In this case it also sounds like an alternative is to set up a regular WMF account and have Qualtrics use that as a regular user instead. This sounds like a better alternative to me, but I don't know what Byron/OIT's concerns were and they may well be justified. Could one of you give more background about this and why this option was not favored?

Thanks for the details, @faidon. It makes sense that we would not want to give full mail-sending authority to a third party, no matter how trustworthy. It sounds like giving Qualtrics access to our SMTP relay would run into the same problem?

You are correct that a subdomain (surveys.wikimedia.org, for example) would work just as well for our purposes.

In this case it also sounds like an alternative is to set up a regular WMF account and have Qualtrics use that as a regular user instead. This sounds like a better alternative to me, but I don't know what Byron/OIT's concerns were and they may well be justified. Could one of you give more background about this and why this option was not favored?

Yes, technically, this is definitely an option as well, but as I understood it Byron had some security concerns (what a coincidence :) @bbogaert, could you elaborate a bit?

Hi @faidon ,

I found a workaround to avert our security concerns, and use gmail smtp, because Neil did not need the "reply-to" address to be qualtrics@wikimedia.org. If the "reply-to" address was needed we would have had to place cn=qualtrics in ou=people, ou=corp, ou=wikimedia, ou=org instead of ou=qualtrics, ou=corp, ou=wikimedia, ou=org so the address would receive mail. The ou=qualtrics, ou=corp, ou=wikimedia, ou=org is not replicated in production LDAP and does not receive mail.

The security concern was that if cn=qualtrics had been in the ou=people, ou=corp, ou=wikimedia, ou=org it would have had access to other G-Suite products besides mail (Drive, Calendar, Hangouts, etc.). However, because we placed cn=qualtrics in ou=qualtrics, ou=corp, ou=wikimedia, ou=org we were able to turn off all other services except G-mail. I did look for a way to turn off G-Suite Apps at the user level, but this was not an option. Also, there was not a "special way" to have a SMTP relay user that was "out-of-band" of a regular user. Placing the qualtrics user in a different object unit was the most elegant solution I could find.

I hope this solutions will work for everyone. Please, let me know if we need to change it.

Thanks,
Byron

Removing Ops since it seems like there's no action needed from them. Keeping the task open while we set up Byron's workaround.

Alright, thank you @bbogaert for the workaround, that was smart! Much appreciated.

Good luck with your survey @Neil_P._Quinn_WMF :)