SendGrid Parse API and SaaS app

2
votes

I would like to add the ability for users to send an email to an address that automatically saves the attachments as documents and saves the email as html, etc.

I think I understand how I can write the functions, but I'm uncertain on how to ensure the security. My application is designed as single code, but each customer has their own database and subdomain. The app looks at the subdomain and determines the database to use for authentication, etc. (There is no master db.)

First, I thought sendgrid would give you a custom email address to use like [email protected] that you could forward to for testing or real use but I don't see that anywhere. I would probably set up a separate domain

How do I ensure that emails sent from user from companyA gets saved in their db? I've thought of:

The code can find the right db, look at the 'from' email address to see if it matches an existing user, then perform the desired functions. However, that doesn't seem too secure. I also am going to want several different email addresses that a user can use that performs different functions ('add to existing part, add to new part, don't add document, etc.)

I'm looking for a better setup that preferably allows for non-ugly email addresses. What do others do?

1
c#saassendgrid

1 Answers

1
votes

It sounds like you already have subdomains for each company. Are these used for email at all right now, or can you change the MX records for the subdomains? If you can programmatically alter your DNS, then it would be very easy to add a SendGrid parse MX record for each subdomain when it is created. Then you could use [email protected].

For security, I think you're on the right track with checking against a user in your database. Assuming your clients have their email properly configured, you could check SPF via the Authentication-Results header if you are concerned about spoofs.