AMO should use a sender of its own domain for outbound emails

[bqbn]

Describe the problem and steps to reproduce it:

Outbound emails from AMO sometimes appear to be sent from domains other than its own. For instance, some outbound emails are observed as originating from [email protected]. Meanwhile, AMO uses a different email provider than mozilla.org does for sending emails. This arrangement works because the DMARC policy of mozilla.org is relatively permissive. Presently, the DMARC policy of mozilla.org is as follows:

$ dig +short _dmarc.mozilla.org TXT
"v=DMARC1; p=none; adkim=r; aspf=r; rua=mailto:[email protected],mailto:[email protected]"

This situation may lead to email reception issues in the long term.

What happened?

What did you expect to happen?

I propose that we explore the possibility of sending emails using the appropriate domain for each environment. For example, in the staging environment, we could use [email protected] as the sender, while in production, we would use [email protected].

This approach would enable us to configure distinct DMARC policies for each environment, without being dependent on the DMARC policies established by our parent domain.

Anything else we should know?

As for rollout, we should proceed env by env, ensuring that email sending functions correctly for one env before moving on to the next.

┆Issue is synchronized with this Jira Task

[diox]

See also https://github.com/mozilla/addons/issues/6637. Stealing my comment from that issue, we have the following settings governing what From we use:

• ADDONS_EMAIL (or its alias DEFAULT_FROM_EMAIL), which is "Mozilla Add-ons <[email protected]>"
• NOTIFICATIONS_FROM_EMAIL, which is "notifications@%s" % settings.INBOUND_EMAIL_DOMAIN, where INBOUND_EMAIL_DOMAIN is coming from an env variable (defaults to addons.mozilla.org). In addition the name of the user that triggered the activity message is added before the email.

[diox]

Less of a priority now that DMARC setup has been adjusted to verify our emails as valid in https://mozilla-hub.atlassian.net/browse/IO-2807

Although it's probably a good idea still to move to addons.mozilla.org and make sure we have DMARC setup for that domain as well.

[bqbn]

Yeah, let's wait and see how the new DMARC setup works and then make a decision on this ticket later.

[KevinMind]

Old Jira Ticket: https://mozilla-hub.atlassian.net/browse/ADDSRV-795