It seems Google Apps customers cannot test (self-to-self) Actions through Apps Script as outlined in this example: https://developers.google.com/gmail/markup/apps-script-tutorial#creating_the_project despite having a valid SPF.
According to https://developers.google.com/gmail/markup/registering-with-google you can send them self to self, and it should work without pre-registering, provided the email goes through SPF or DKIM authentication.
We have not set up DKIM, but we do have a valid SPF for our domain. The first part of our SPF record is:
v=spf1 include:_spf.google.com
When I follow the tutorial linked above and I receive the email, the header shows:
Received: from mail-it0-x245.google.com (mail-it0-x245.google.com. [2607:f8b0:4001:c0b::245])
by mx.google.com with ESMTPS id i196si1416642itc.102.2016.06.25.10.03.10
for <my email address>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 25 Jun 2016 10:03:10 -0700 (PDT)
Received-SPF: pass (google.com: domain of 3trluvwgicd0sahffhmrzjqe.bnlsahffhmrzjqe.bnl@maestro.bounces.google.com designates 2607:f8b0:4001:c0b::245 as permitted sender) client-ip=2607:f8b0:4001:c0b::245;
Authentication-Results: mx.google.com;
dkim=pass [email protected];
spf=pass (google.com: domain of 3trluvwgicd0sahffhmrzjqe.bnlsahffhmrzjqe.bnl@maestro.bounces.google.com designates 2607:f8b0:4001:c0b::245 as permitted sender) smtp.mailfrom=3TrluVwgICD0sahffhmrZjqe.bnlsahffhmrZjqe.bnl@maestro.bounces.google.com
Received: by mail-it0-x245.google.com with SMTP id 13so102904690itl.0
for <my email address>; Sat, 25 Jun 2016 10:03:10 -0700 (PDT)
According to the answer on this post (Actions Tutorial does not work despite SPF validation):
"The SPF domain must match the email sender domain.
If you are sending emails from [email protected], the SPF domain must be mydomain.com.
Your headers show <host>@maestro.bounces.google.com
as the domain, update your domain configuration to sign emails properly and
you should be all set."
We have no control over how Apps Script generates email headers, so it seems Apps Script emails will always show @maestro.bounces.google.com.
Which finally brings my question: How can we test Actions via Apps Script if we cannot control the header? Apps Script triggered emails will always go through maestro.bounces.google.com, not [our domain].
Ultimately our goal is to use Actions entirely within our domain, and most likely through Apps Script each time. It would be great if Google Apps customers could allow Actions to pass (locked down for emails sent within the domain) through GA Control Panel, versus having to follow the very necessary restrictions imposed for domain-to-domain.
If there is another way for me to test this or something I've overlooked, please advise. Thanks!
Action tests that are not pre-registered are only testable self-to-self if you send them from personal (gmail.com) accounts. In order to make them work from a Google Apps for Work account, you currently need to register as if you were sending to someone else.
I've asked Google to open up this functionality so folks using work accounts can follow the tutorials, but if you are just learning this area, for now it is best to use a personal Gmail account.
Thanks Franco - your comment was the right answer but I could not see a way to mark it as such.