I'm working on a contact management/lightweight CRM app, and I'd like to be able to allow my users to send email to their contacts through my application. Obviously this opens up a huge can of worms in terms of security, so I'd like to know what can be done to mitigate or minimise the risk to both my organisation and genuine (non-spamming) users, as well as keeping my app reputable.
The application itself will make API requests to a third-party mass SMTP provider and let them do the actual sending, rather than send it directly from our server(s).
These are some current precautions I am taking:
- Users will only be allowed to send email to their contacts or accounts already on the system, no mass emailing lists of addresses only.
- Emails are rate limited, each user will only be able to send n emails in a 24 hour period where n is based on their subscription plan.
- Using the "on behalf of" feature for the sender address.
What I would specifically like to know is:
- Some users may want to send from a no-reply or other corporate address, different from the email they use to log in. How should I best verify users own or have access to the address? I can't always use verification emails because if they want to send from an unmonitored address they obviously won't be able to check for said verification email.
- Is anyone able to explain how I should make use of SPF records (or get my users to make use of them) in this instance? I have read about them but my knowledge is still shaky in this area.
- Will there be any special precautions to take if we scale the app over multiple servers?
As an additional note, like the market leader Salesforce, I intend to allow my users to send an unlimited number of single (non-bulk) emails to other users, but above I am talking specifically about emails sent to non-users.