For your mail administrator

What arrives, and when

Four kinds of message, one sending domain

Message	From	To	Attachment
The ask: "someone wants to meet you, reply with your free times"	`meet+<12 letters>@beargrass.ai`, display name "Beargrass SchedBot for <organizer>"	each participant, privately	none
A receipt after each reply	the same address	the person who replied	none
One nudge after 48 hours of silence	the same address	the quiet participant	none
The invite	the same address, on the organizer's behalf	everyone on the organizer's To line	`invite.ics`, `text/calendar`, iTIP METHOD:REQUEST

Every message also carries Auto-Submitted: auto-generated, In-Reply-To and References pointing at the organizer's own email, and a plain-text part beside the HTML. Links appear only in the invite: an add-to-calendar link for Google and one for Outlook. The twelve-letter tag is one meeting and changes for every meeting; allow-list the domain, not an address.

Authentication, measured

SPF, DKIM and DMARC, all aligned to the sending domain

Outbound mail is signed by Cloudflare Email Sending; SPF and DKIM both align with beargrass.ai, and DMARC is at reject. Read 2026-09-17 through 1.1.1.1 and 8.8.8.8, all four records present as shown. Google's receiving verdict the same day was spf=pass dkim=pass dmarc=pass.

dig +short MX beargrass.ai                    # route1/2/3.mx.cloudflare.net
dig +short TXT beargrass.ai | grep spf        # v=spf1 include:_spf.mx.cloudflare.net ~all
dig +short TXT cf2024-1._domainkey.beargrass.ai   # the DKIM public key, RSA-SHA256
dig +short TXT _dmarc.beargrass.ai            # v=DMARC1; p=reject;

What to allow

Four rules, and the two things that can go wrong

Sender domain beargrass.ai, any local part (meet+*@).
Attachment type text/calendar from that domain, on messages whose subject begins with "Re:".
Link rewriting is safe: the two add-to-calendar links can be rewritten; nothing depends on them.
Attachment stripping is survivable: users still have the links, and the invite text states the time in words and as epoch seconds.

Who can start one

An invited domain, authenticated for exactly that domain

The gateOnly an email whose From is on an invited domain, and whose DKIM or DMARC result at Cloudflare aligns with exactly that domain, opens a meeting. A forged From is refused before anyone is written to.

The listA short list of domains held by BeargrassAI; a listed domain admits its subdomains. A domain is added by asking and removed the same way.

The capOne organizer may start ten meetings a day and forty a month. Past that, they get a receipt saying so and nothing else goes out.

What is storedFor one meeting: the names and addresses on the To line, the organizer's own words, each reply's free times, the chosen slot. One record per meeting on Cloudflare, deleted 30 days after the window ends. Nothing is read from any calendar; no third party receives any of it.

meet-abuse@beargrass.ai reaches a person. To be removed from the invited list, or to have a meeting's record deleted early, write there.

The facts about the mail it sends

Four kinds of message, one sending domain

SPF, DKIM and DMARC, all aligned to the sending domain

Four rules, and the two things that can go wrong

An invited domain, authenticated for exactly that domain