Currently some employees in our organization uses Google calendars, they sign up for google calendar using our own email domain, user1@owndomain.com, and when they create meeting invites, Google's calendar server will send meeting invites using FROM address of user1@ourdomain.com to meeting attendees. I include _spf.google.com in our SPF records, allowing google servers to send emails on behalf of @ourdomain.com.
However, if the attendee has user2@ourdomain.com email address, when google server attempt to deliver a meeting invite from user1@ourdomain.com to user2@ourdomain.com, our email server (postfix) will reject the email since "reject_sender_login_mismatch" has been specified:
smtpd_recipient_restrictions =
reject_unauth_pipelining,
reject_sender_login_mismatch, reject_unknown_sender_domain, permit_mynetworks, permit_sasl_authenticated
What is the most appropriate solution to allow only the google servers to deliver to @ourdomain.com without logging in and bypassing reject_sender_login_mismatch? And is there a way to specify _spf.google.com as the list of google servers without putting in the exact IP addresses (as the servers may change in the future)?