Currently some employees in our organization uses Google calendars, they sign up for google calendar using our own email domain, email@example.com, and when they create meeting invites, Google's calendar server will send meeting invites using FROM address of firstname.lastname@example.org to meeting attendees. I include _spf.google.com in our SPF records, allowing google servers to send emails on behalf of @ourdomain.com.
However, if the attendee has email@example.com email address, when google server attempt to deliver a meeting invite from firstname.lastname@example.org to email@example.com, our email server (postfix) will reject the email since "reject_sender_login_mismatch" has been specified:
smtpd_recipient_restrictions = reject_unauth_pipelining, reject_sender_login_mismatch, reject_unknown_sender_domain, permit_mynetworks, permit_sasl_authenticated
What is the most appropriate solution to allow only the google servers to deliver to @ourdomain.com without logging in and bypassing reject_sender_login_mismatch? And is there a way to specify _spf.google.com as the list of google servers without putting in the exact IP addresses (as the servers may change in the future)?