Gmail architecture

This page describes the to-be setup after email migration from gsuite has taken place

1. Outgoing server finds MX records for cloudflare
2. Cloudflare¹⁾ checks internal database and forwards the email to gmail

1. Gmail authenticates to AWS SES²⁾ servers using unique IAM username/password
   1. each unique user is restricted to only be able to send from their own set of email addresses
2. AWS SES signs the email using DKIM keys stored in internal SES database for the sender domain
3. AWS SES looks up destination MX server and sends email to destination email server
4. (optional) Destination email server looks up SPF, DKIM and DMARC via DNS