I run a web service that should be able to send out e-mails using a company address, e.g. email@example.com. I do not, however, want to give this service access to the mail server of company.com (for security reasons) and instead want to send the e-mails from another server (e.g. foo.com)
I my understanding, I can achieve this by adding SPF / DKIM records to the DNS configuration of company.com, mentioning foo.com as a valid domain for sending e-mail as .....@company.com.
The potential problem I see with this (as far as I understand DKIM / SPF) is that if my foo.com mail server gets hacked it will be able to send validated e-mail for all addresses in the ........@company.com domain (e.g. from firstname.lastname@example.org), which is of course not acceptable.
Is there a way to specify the SPF / DKIM records such that only a single e-mail address (email@example.com) is allowed to send mail via foo.com?
I read that DKIM supports selectors which might be up to that task, but I could not find any information about which types of selectors are accepted/understood by e-mail servers, so I'm unsure if this would be the right strategy to implement this.
Of course I'm also open to alternative solutions for making sure that my service is able to send validated e-mails as firstname.lastname@example.org while not being able to impersonate any other e-mail account in case it gets compromised.