Provisioning an Email
We need an email provisioned for Hackley Clubz in hackleyschool.org so that we can send emails to people from Hackley Clubz that are delivered to people.
We only plan to send emails for club announcements. (No login resets because there are no logins, we use the google identity signin with a valid @students.hackleyschool.org or @hackleyschool.org account)
This email could be:
hackleyclubz@students.hackleyschool.org (or another email if you prefer)
We plan to turn on two-step authentication for this account and create an “app password” that is used from our applicaation to authenticate with Gmail’s SMTP servers.
How Hackley Clubz will use this account
- The Hackley Clubz server connects to
smtp.gmail.comover TLS (port 587) and authenticates as this account to send announcement emails. This is Google’s standard, supported way for an application to send mail as a Workspace user. - Each announcement is sent as one email. Replies do not go to this mailbox: the message’s Reply-To is the club leader who sent the announcement, and Reply-All reaches the club’s leadership. Members’ addresses ride BCC, so a student can never reply-all to a whole club.
- The mailbox itself receives almost nothing — mainly bounce notices for addresses that no longer exist. We suggest forwarding it to whoever administers Hackley Clubz so bounces get noticed.
Configuration Instructions
The following steps should be completed by a Google Workspace administrator.
1. Create the account
In the Google Admin Console (https://admin.google.com/), create a new user,
e.g. hackleyclubz@students.hackleyschool.org.
- It must be a real, licensed user account — a group or alias will not work, because SMTP authentication requires an account with its own password.
- It can be hidden from the global address book
- Place it in any organizational unit; nothing about Hackley Clubz sign-in (see IT Onboarding Instructions) depends on this account’s OU.
2. Make sure “app passwords” is enabled on the account.
An App Password only allows the application to act as this one account over IMAP/SMTP. It does not grant any access to the Admin Console or to any other user’s data, and it can be revoked at any time from the same screen.
NOTE: Google Workspace allows an account to email roughly 2,000 recipients per day. This should be more than enough for what we need. There’s a “SMTP Relay Service” that could be enabled it we ever need to go over that.
Security Notes
No administrative access is required
Hackley Clubz does not need:
- Google Workspace administrator credentials
- Domain-wide delegation or service-account impersonation
- Access to any other user’s mailbox or data
The App Password authenticates Hackley Clubz as this single sending account, nothing more.
What students receive
Recipients see a normal email from
“{Club Name} via Hackley Clubz” <hackleyclubz@students.hackleyschool.org> containing
the announcement and a link back to the club’s Announcements page. Replies go
to the club leader who sent it — never to the whole club.
IT Configuration Summary
Provision: One Google Workspace user, e.g. hackleyclubz@students.hackleyschool.org
Deliver securely: login information for that account.
Google’s documentation for sending mail from an application through a Workspace account is available here:
(Another option if this doesn’t work is for you to generate the app password for the account instead of me, but I think it’s better if I can log into the account so I can reset the password if I need to)