# Category not accepting "anonymous email" from known users
**URL:** https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871
**Category:** Bug
**Created:** [20 april 2016 om 12:13 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871 "2016-04-20T12:13:33Z")
**Posts on this page:** 10
**Page:** 2
### Author:  [@movonw](https://meta.discourse.org/u/movonw)
#### Post date: [15 juli 2022 om 06:57 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/22 "2022-07-15T06:57:12Z")
I looked at the code and it seems to me that:
1. if authserv\_id is enabled
2. Email::AuthenticationResults will assign either fail or pass verdict, which results in enqueue or accept action
3. Posts with enqueue action will be marked for review/approval (`lib/new_post_manager.rb - self.post_needs_approval?`)
Is my reasoning correct?
Does this mean attempts at spoofing would probably end up in review?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [23 februari 2023 om 05:14 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/23 "2023-02-23T05:14:49Z")
> [@movonw](#):
>
> Is my reasoning correct?
> Does this mean attempts at spoofing would probably end up in review?
Sort of, this will be sent to the approve queue if DMARC fails, but if it is totally absent it will still go through.
Perhaps one way of pushing forward would be to add an explicit site setting that basically say “site operator accepts risk” and if enabled allow mapping based on email
---
### Author:  [@Simon\_Manning](https://meta.discourse.org/u/Simon_Manning)
#### Post date: [4 juni 2023 om 14:22 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/25 "2023-06-04T14:22:58Z")
> [@sam](#):
>
> Perhaps one way of pushing forward would be to add an explicit site setting that basically say “site operator accepts risk” and if enabled allow mapping based on email
I’m a bit confused by the bug vs. intended behaviour debate. The way I have interpreted it is that for security reasons, creating new topics via email is not permitted if the email address matches an existing non-staged user; this is because email addresses can be spoofed and therefore users could be impersonated.
Replies are presumably acceptable because the address includes the reply key, demonstrating that the sender was the recipient of the notification email and is therefore likely the real user.
* * *
If that interpretation of the intended behaviour is correct, it is contradictory to what I’m actually experiencing. If my user does have permission to create in the category and I send an email from my registered email address to the category’s `email_in` address, the email address is matched to my user and a new topic is created by my user.
This happens irrespective of whether `accept emails from anonymous users with no accounts` is enabled, since my user does have permission to create.
The current situation seems to be: (with email in `anonymous users` enabled)
1. Email received from address with no user; staged user created, new topic **created**.
2. " " " address with staged user; staged user matched, new topic **created**.
3. " " " address with real user with create permission; real user matched, new topic **created**.
4. " " " address with real user without create permission; real user matched, new topic **rejected**.
( **Note: I did not test 4 just now** ) With email in `anonymous users` enabled, I would expect 3 and 4 to always behave the same. Whether that is both rejected to protect against impersonation or both accepted on the basis that a real user shouldn’t have fewer permissions than an anonymous user, they shouldn’t have different results.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [5 juni 2023 om 00:57 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/26 "2023-06-05T00:57:18Z")
The OP is all about secured categories (eg a category that anonymous can not even see). In that case staged users would certainly be rejected today, no?
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [5 juni 2023 om 01:17 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/27 "2023-06-05T01:17:28Z")
Yes, mail from staged/non-activated users would (should?) have not been accepted in my original scenario.
---
### Author:  [@Simon\_Manning](https://meta.discourse.org/u/Simon_Manning)
#### Post date: [5 juni 2023 om 12:39 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/28 "2023-06-05T12:39:30Z")
> [@sam](#):
>
> The OP is all about secured categories (eg a category that anonymous can not even see). In that case staged users would certainly be rejected today, no?
I’ve just tested this to confirm the behaviour on our instance (20 commits behind, can’t see anything related in the changes). We have all posts by trust level 0 users require approval and I wasn’t sure if that would affect the route, so I extended the steps to test without that interfering.
These steps all relate to a category where the admin group has see/reply/create and no other permissions are set, an email in address is set and `accept emails from anonymous users with no accounts` is enabled.
“\>” denotes an effect rather than an action.
- Send email from address with no user
- \> Staged user is created, new post goes into review queue
- Approve post
- \> New topic is created in private category
- Change trust level of staged user to 1
- Send another email from same address
- \> New topic is created in private category
If that didn’t happen, the `accept emails from anonymous users with no accounts` setting would have no purpose on categories that do not have either `everyone` or `trust_level_0` with create permission.
I believe this is equivalent to #4 in the OP where the OP describes both #3 and #4 being expected to result in a new topic, however only #4 does.
* * *
> [@sam](#):
>
> I think the behavior here is deliberate a fix here is going to have to be pretty comprehensive.
>
> The trouble with allowing people to associate a topic with an existing account is that anyone can spoof anyone’s email.
>
> …
>
> Without this protection this feature would be wide open to impersonation which is very risky.
With [my previous post](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/25) (before “The current situation”), I was mostly aiming to discuss this point more generally, which seems to argue that #3 should not work because the way it currently works protects against users being impersonated.
However, as I describe in that post, that protection doesn’t exist where a matched user has create permission.
---
### Author:  [@Julien\_Palard](https://meta.discourse.org/u/Julien_Palard)
#### Post date: [3 november 2025 om 09:50 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/29 "2025-11-03T09:50:59Z")
It’s still an issue on 3.6.0.beta3-latest.
---
### Author:  [@lavamind](https://meta.discourse.org/u/lavamind)
#### Post date: [29 januari 2026 om 15:03 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/30 "2026-01-29T15:03:26Z")
Over at the [Tor Project forum](https://forum.torproject.org) we’ve been mirroring mailing lists on the forum but the topics created as mirrors of the mailing list are often missing messages. The issue was troubleshooted and identified in another topic: [Unexplained Email::Receiver::InvalidPost errors](https://meta.discourse.org/t/unexplained-email-invalidpost-errors/377793) .
Would it be possible to find a solution so that mailing list messages from both known and unknown users are accepted? Otherwise, those mailing list mirror categories are quite broken, and it can become difficult to follow conversations because of the rejected messages.
---
### Author:  [@Julien\_Palard](https://meta.discourse.org/u/Julien_Palard)
#### Post date: [14 mei 2026 om 15:50 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/31 "2026-05-14T15:50:44Z")
We still hit this issue with `2026.5.0-latest`.
---
### Author:  [@Julien\_Palard](https://meta.discourse.org/u/Julien_Palard)
#### Post date: [12 juni 2026 om 06:50 UTC](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871/32 "2026-06-12T06:50:25Z")
> [@sam](#):
>
> The trouble with allowing people to associate a topic with an existing account is that anyone can spoof anyone’s email.
Relying on SPF/DKIM/DMARC here looks good to me.
[Previous page](https://meta.discourse.org/t/category-not-accepting-anonymous-email-from-known-users/42871.md?page=1)