Email send suddenly failing with "Unauthorized sender" in production app

[Michael David Pedersen]

Hello,

I'm running a production app which relies critically on the ability to send emails; it is for example needed for new user signup. This has been working fine, until some time between January 9th and today. Now, when attempting to send an email, I get an error saying "Unauthorized sender".

The application in question is running with increased mail quota; it has billing enabled; and it uses custom domains. The sender email is a user on this custom domain which is configured to have access to the application. 

The application is written in Java, and uses javax.mail.Transport to send emails. The Transport.send() method now fails with the following error:

java.lang.IllegalArgumentException: Unauthorized Sender: Unauthorized sender.

I have confirmed that the sender is correct and has access to the application. In fact nothing has changed in the code since January 9th, when this all worked fine, and now (there has been no deployments since December, and there has been no changes to the application configuration in the Google Cloud Console).

This is obviously a major problem, and I would greatly appreciate some assistance on the matter ASAP.

Thank you,

Michael

[Karolína Netolická]

Hello Michael, 

Can you check whether the email address in the "From" field of the email is on the Email API Authorized Senders list? You can view and edit this list here:

https://pantheon.corp.google.com/appengine/settings

[Michael David Pedersen]

Hello Karolína,

Thank you for your quick reply. 

The link you sent goes to a form where I have to type in an @google.com email address to sign on. That doesn't seem right (I don't have one)?

I'll send you my app ID and from email address in a private message shortly in case that's helpful.

Cheers,

Michael

[Karolína Netolická]

Apologies for the incorrect link; try this: 

https://console.developers.google.com/appengine/settings

If adding the sender to the Authorized Senders list doesn't solve the problem, let me know.

FYI, there are some restrictions on who can add whom to this list, documented here:

https://cloud.google.com/appengine/docs/python/mail/

On Tuesday, January 12, 2016 at 7:34:24 AM UTC-8, Michael David Pedersen wrote:

[Michael David Pedersen]

Hi again,

Thank you for the link. The sender is indeed not on the list, although it must have been in the past since emails have worked fine up until now.

I've tried adding the sender but get a message saying "Unable to add an email address from another domain". Looking further, it seems that my custom domain settings, including the SSL certificate, have complete disappeared from the application in the console!

Let me stress again: I am the only person with access to the cloud console, and I have definitely not made any changes anywhere in the last couple of days. How can this happen?? The custom domain, and the SSL, continue to be functional despite the console showing no trace of these; it is currently only emails that are affected.

I could try to configure custom domain and SSL all over again, but 1) I'm worried this will mess something up, and 2) I'd like to know how what has happened is possible. Any ideas?

Thank you,

Michael

[Michael David Pedersen]

Hello again,

In case anybody else comes across this: it seems that my custom domain validation failed to renew (perhaps the required DNS records got corrupted or disappeared). Hopefully re-validating will fix this issue and allow me to once again add the relevant email address to the senders list.

Thanks for your help Karolína.

Cheers,

Michael

[Ster Nem]

Karolina, I'm facing a similar issue with unauthorized sender, though the email account is an application owner and I see it in the Email API Authorized Senders list.  This is URGENT as the emails are used to confirm orders and provide status updates on orders that are being placed to restaurants.

To restate, do.not...@customdomain.ca is an application owner/administrator and things were working fine before.  Today at around 6PM ET, all emails have stopped.

Any (urgent) help you can provide?

[Ster Nem]

I wonder if the strictness around non custom domain senders restricted, even if they are application admins has recently changed.

I ended up adding a custom domain (that happens to be a googles apps associated domain).  I could not remove the do.not.reply for my custom domain (as I thought to remove and re-add it).  I added sup...@customdomain.ca (not an application owner at that point) and forced all the email senders to be from that email instead of the do.not.reply. 

I'd like to clean this up if this is no longer allowed, but at least my situation isn't as critical as before.

[Michael David Pedersen]

Ster, given that you also have problems, it does seem that there have been some breaking changes to email on the platform, beyond simple domain validation failure that I initially assumed. This SO post is related (see the comments):

http://stackoverflow.com/questions/34740906/unable-to-add-an-email-address-from-another-domain-in-gae

Although the problem is now resolved for me, it would be nice to get some reassurance that this won't happen again. 

[Ster Nem]

Thanks for the link Michael, I agree it does appear that a breaking change happened.  And in my case I have an in limbo "do.not...@customdomain.ca" that I can't use and can't clean up.  Disappointing that this broke without warning.  I hope things are stable now.