Add Email Sending Support

[Morgul]

Add the ability for RPGKeeper to send emails.

This should, probably, go through a noreply@rpgkeeper.com, which should (in theory) be able to be set up for the domain.

Probably easiest to just do one through gmail, but also theoretically doable through my own hosted SMTP server, I think? Not sure how that would work.

[Morgul]

Figure we can start with gmail's smtp relay since I have a few google workspace accounts.

Instructions from ChatGPT:

1. Pick a sender

• Use no-reply@rpgkeeper.com (make it a real mailbox or an alias that can send).

2. Enable DKIM signing (Workspace)

• Admin Console → Apps → Google Workspace → Gmail → Authenticate email (DKIM)
• Generate DKIM record → add the TXT record in DNS → enable DKIM signing.

3. Add/verify SPF (DNS)

• Ensure the domain has one SPF TXT record that includes Google:

  • v=spf1 include:_spf.google.com ~all

• If SPF already exists, merge it (don’t create a second SPF record).

4. Add DMARC (DNS)

• Add TXT record at _dmarc.rpgkeeper.com:

  • v=DMARC1; p=none; rua=mailto:dmarc@rpgkeeper.com; adkim=s; aspf=s

• Ensure dmarc@rpgkeeper.com exists (alias is fine). (We can tighten p= later.)

5. Configure SMTP relay service (Workspace)

• Admin Console → Apps → Google Workspace → Gmail → Routing → SMTP relay service

• Configure:

  • Server: smtp-relay.gmail.com

  • Port: 587 (STARTTLS)

  • Restrict who can send:

    • Allowlist the Linode VPS outbound IP (preferred), and/or require auth per Workspace options

  • Restrict “envelope from” / sender to our domain (@rpgkeeper.com) so this can’t be abused.

6. App config (use SMTP submission, not port 25)

• SMTP host: smtp-relay.gmail.com
• SMTP port: 587
• Security: STARTTLS
• From: no-reply@rpgkeeper.com
• (Optional) Reply-To: support@rpgkeeper.com

7. Smoke test

• Send test emails to a Gmail address + an Outlook address.
• In the received message headers, confirm SPF=pass and DKIM=pass.
• Confirm it lands in Inbox (not Spam).

---

On hiccup might be that right not rpgkeeper.com isn't aliased to any of them, but that should be straight forward.