00:11 <abliss> well, i discovered good news and bad news about matrix federation. The good news: if you own the domain example.com, and can arrange for https://example.com/.well-known/matrix/server to serve a static json blob with your big ugly sandstorm grain url in it, then it looks like people will be able to chat you at @user:example.com ... so, there may be no need for my apache proxy hack (assuming there's another way to punch through the

00:11 <abliss> authorization header)

00:12 <abliss> the bad news: because of this, the matrix http client code is pretty complex and weird, which is making it tricky to add http_proxy support.

00:14 <abliss> (it also supports delegating through an SRV dns record. but since we don't have a capnp-based DNS proxy, i'm hopefuly that the `.well-known` delegation will suffice)

15:01 <JacobWeisz[m]> Shouldn't Gmail still check the SPF records from G Suite emails?

15:02 <JacobWeisz[m]> It looks to me like Gmail might be able to receive email sent from a G Suite account even when that domain is configured to hardfail unless the email comes from a totally different service.

19:58 <JacobWeisz[m]> Seems relatedish to my experience: https://www.securityweek.com/google-patches-email-spoofing-vulnerability-after-public-disclosure

19:59 <JacobWeisz[m]> It seems once you get inside Google's mail system, SPF isn't checked and doesn't matter.

19:59 <JacobWeisz[m]> Presumably they assume G Suite's domain ownership verification is adequate to the task.