Google App Engine - Add Email API authorized senders from Domain Alias

Question

I have a Google App Engine app, with two custom domains (let's say, for example, a.com and b.com).

Domain b.com is a Google App alias for a.com i.e. Under Google Apps Admin Console -> Domains -> Add/Remove Domains b.com is listed as "Domain alias for a.com".

I would like our app to be able to send email from our AppEngine app from addresses at b.com, as in me@b.com or an email alias like alias@b.com. The documentation indicates that it is possible, but it does not work as documented or I have overlooked something.

If I try to send email with the App Engine Mail api from me@b.com or alias@b.com I get the error of "InvalidSenderError: Unauthorized sender."

The remedy for this would seem to be, as the title of this question suggests, to add authorized senders under:

Cloud Console -> App Engine -> Settings -> Application Settings -> Email API authorized senders

When I attempt to add e.g. me@a.com it is added to the list of authorized senders, as expected. When I attempt to add me@b.com, alias@a.com or alias@b.com it fails.

The specific error I get from Cloud Console when I attempt to add the addresses is:

Unable to add authorized senders

You don't have permission to add these users to the authorized senders list. Learn more

Following the above link, the relevant bit about permissions would be:

... a message must be sent by ...

• Any email address listed in the Cloud Platform Console under Email API Authorized Senders

...

... domain administrators of domains managed by Google Apps can add any user in their domain to the list.

If you have one or more aliases set up for your Google Apps domain, you can send email from email addresses that use the domain alias. For example, adding "xyz@domain.com" to the Authorized Senders list will have the effect of also allowing sending email from "xyz@alias.com".

The document notes that SPF records must be properly configured as the documentation indicates, and they are, namely:

$ dig a.com txt
...
a.com.      604556  IN  TXT "v=spf1 include:_spf.google.com ~all"
...

$ dig b.com txt
...
b.com.      604556  IN  TXT "v=spf1 include:_spf.google.com ~all"
...

Although not necessary, DKIM has been configured from all the domains, and all the MX records point to Google Apps.

Under Google Apps Admin Console -> Users -> Me -> Account -> Aliases the following are among those listed (among others):

• me@b.com
• alias@a.com
• alias@b.com

So the question would be: What, if anything, am I overlooking here that is either a.) preventing sending from the domain aliases and/or b.) preventing sending from the alias email addresses in general? If I hae not overlooked something, what recourse may follow?

As an aside, a workaround would be to use a third party mailer e.g. Mandrill, MailGun, or SendGrid. Those are overkill, a hassle, and unnecessary complexity for what is a very simple use case on our end, so a solution over AppEngine would be ideal.

Answer 1

I ultimately solved this by using PostMark.

There are a number of other solid options, including SendGrid, Mailgun, Mandrilla, MailChimp, and others.

We settled on PostMark because it has an agreeable templating system and focuses on transactional email deliverability.