What best practices should be considered when giving a third party access to email for your domain

Question

Our company wants to work with an outsourced 3rd party provider who have the need to send and receive emails. We'd like these emails to come from our domain (or a subdomain) to help customers trust the legitimacy of the emails and reduce the chance they thinks it's phishing or spam. We also believe it helps improve the branded feel of the interactions. A secondary goal is that we'd like the third party to manage the branding and templates like standard legal footers of the emails.

We already use SAAS providers like Mandrill (outbound only) and Intercom (inbound and outbound), who are able to send emails on behalf of our domain by us verifying ownership and then modifying our DNS records to ensure things like SPF & DKIM are applied as per our DMARC policy. We then have a GSuite GMail app routing rule which forwards the incoming mail to Intercom.

In this instance, the third party is proposing that we give them direct access to our GSuite via a user account or that they route their email through our mail servers (which for us is google's mail servers). I believe that this is undesirable for a few reasons:

1. SSO (login with google), which may give access to systems which we consider internal.
2. They aren't internal employees and the presence of an account means that we are charged for the user account and they'll be automatically added to our all@ email group. We'll also have to be careful to disable apps like drive and calendar, since all we want is email.
3. It's just complexity we haven't had to manage with our SAAS providers, where the same has been achieved.

If relevant, the third party has informed us that they use OWA currently and the interactions are manual (e.g. human typing emails). There may be some flex to get them to not use OWA.

My question is are there best practices to consider here or any well trodden paths to achieve this? Bonus if there is a SAAS type offering which can help solve this problem (I considered Intercom, but that does a lot more besides and that reflects in price).

Answer 1

These reasons you give against giving them access to your GSuite sound quite convincing to me. If I were you, I would let them setup their own mailserver, which is configured to use one of your mailserver as an outbound relay. I would further setup a private IPSec VPN, and restrict the relay access to that one IP inside the private IP domain of the IPSec VPN. Feel free to add TLS client authentication to increase security on that link. This has some advantages:

• You can add the DKIM signature yourself and anything, you'd like to do further with those emails
• You can add filters to these outgoing mails which the 3rd party cannot control, so that you stay in control of what is being done in the name of your brand / company

Hope it helps!