fix and improve emailing class list aliases

[milescalabresi]

replace sha with hashlib for python3 to fix issue with emailing class list aliases

[willgearty]

Some additional ideas based on discussion:

1. We should verify sender email addresses in mailgate.py before sending along emails:

• https://pypi.org/project/dkimpy/
• https://pypi.org/project/checkdmarc/
• https://pypi.org/project/pyspf/

2. We should reject any emails from

• a sender email address that isn't associated with an account on [subdomain].learningu.org or learningu.org

[milescalabresi]

We discussed a better way to do it.

1. Catch sender's message and grab the data fields (To, From, Subject, Body, etc.)
2. If the sender's email is not associated with an account on the site:
   a. Do not forward the email
   b. Send the user a bounce message (rate-limit once per day/week/something using something similar to dbmail.MessageRequests to track)
3. If the sender's email is associated with an account on the site:
   a. If there is more than one such account, do some logic to identify the "right" account (options include: prefer admin > teacher > volunteer > student; choose earliest account created; send a bounce and instruct them to merge accounts), say [email protected]
   b. Use SendGrid to send an email to each recipient of the original message (To, Cc, Bcc) individually from [email protected]. We should be able to import and use the send_mail function

[willgearty]

With those changes, this should also fix #3760.

[hwatheod]

Is the purpose of these changes to address the spam abuse reports? Will all emails be sent through SendGrid now?

[milescalabresi]

Yes, the vision is send all emails through SendGrid. That's one benefit but not the only one

…

On Fri, Jul 4, 2025 at 2:52 PM hwatheod ***@***.***> wrote: *hwatheod* left a comment (learning-unlimited/ESP-Website#3832) <#3832 (comment)> Is the purpose of these changes to address the spam abuse reports? Will all emails be sent through SendGrid now? — Reply to this email directly, view it on GitHub <#3832 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKAJDY3HGWJLJC4F7DLXXT3G3EP5AVCNFSM6AAAAAB3VBISQKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTAMZXGA3DAOBWHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>