# Confused by Error Message From Reply-by-Email
**URL:** https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841
**Category:** Support
**Created:** [January 27, 2020, 3:35pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841 "2020-01-27T15:35:28Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@hartz](https://meta.discourse.org/u/hartz)
#### Post date: [January 27, 2020, 3:35pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/1 "2020-01-27T15:35:28Z")
This might just be a personal failing, but I’m a bit confused by some of the error reporting I’m getting after setting up reply-by-email.
When someone replies to a message from an e-mail address not associated with their account, the error message (on a self-hosted Discourse instance) might be the wrong one? It seems like the message one should receive if they sent _to_ an incorrect address, rather than _from_ an unrecognized address.
The message I receive in that case has the subject line **Email issue – Unknown To: Address** , and the body looks like:
* * *
_We’re sorry, but your email message to [“SNIP”] (titled Re: Help Please) didn’t work._
_None of the destination email addresses are recognized, or the Message-ID header in the email has been modified. Please make sure that you are sending to the correct email address provided by staff._
* * *
Changing the From: address in my replies to match the one associated with the account seems to fix the problem.
Is there an easy way to modify this behavior? Have I misconfigured something?
(I should maybe say that what I would really be hoping for is an option to ignore the From: header altogether and instead just use the reply key as discussed [here](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/17); is there any chance of that?).
---
### Author:  [@hartz](https://meta.discourse.org/u/hartz)
#### Post date: [January 27, 2020, 3:52pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/2 "2020-01-27T15:52:37Z")
Ah, maybe this is because it’s a response to a PM, rather than a public topic, and so Discourse doesn’t think that the person sending the e-mail (which it doesn’t recognize as a valid user) should be able to send to that address?
That might explain why it is marking the To: address as invalid, rather than the From: address?
In the meantime, I’ve changed the text of that message to clarify that it could be an issue with `From:` _or_ with `To:`.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 28, 2020, 2:32am UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/3 "2020-01-28T02:32:36Z")
> [@hartz](#):
>
> Changing the From: address in my replies to match the one associated with the account seems to fix the problem.
Why would Discourse accept a random email address, not matching any valid user account on the target site? 🤔
You must always have a valid, authenticated account to post anything in Discourse.
(There is an exception for staged users, but that’s specific to handling an email inbox through Discourse PMs)
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [January 28, 2020, 2:38am UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/4 "2020-01-28T02:38:48Z")
This would be because the permission error is transformed into a “not found” error somewhere in the stack, and then the email code uses the message for “not found”…
---
### Author:  [@hartz](https://meta.discourse.org/u/hartz)
#### Post date: [January 28, 2020, 2:50am UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/5 "2020-01-28T02:50:48Z")
> [@codinghorror](#):
>
> Why would Discourse accept a random email address, not matching any valid user account on the target site? 🤔
One could argue that the `reply_id` (which seems to map both to a topic and the person replying) is identifier enough, and spoofing `reply_id` is harder than spoofing an e-mail address, so it’s effectively just as strong with or without coming from the right e-mail address.
But I’m not _actually_ trying to argue that. What you’re saying here makes total sense. And, after thinking on it, I realize that the thing leading to this behavior is definitely an edge case (we have SSO creating an account with university e-mail addresses, but people sometimes forward those to other addresses, from which they respond).
My real question is about the contents of the error email people receive in that case, which seems like it could be misleading. The real issue, or at least the thing the person receiving the error e-mail has control over in this case, is the “From” address (and the address associated with their account), not the “To” address, as far as I can tell.
Anyway, I already have a workaround by:
- changing the content of that message (love that Discourse is so customizable!) and
- telling people to change their email address if they want to use reply-by-email
but I’m just wondering if it makes sense to change something about what error messages are sent in which situations, given this potential confusion.
If the answer to that is “No, things are fine as-is,” that’s totally fine.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 28, 2020, 3:54am UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/6 "2020-01-28T03:54:39Z")
We do have preliminary support for alternate email addresses per user.
I wonder @sam and @eviltrout when will we formalize this a bit more so users can add a secondary email address? Should this be added to the 2.5 roadmap?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [January 28, 2020, 6:23am UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/7 "2020-01-28T06:23:53Z")
> [@codinghorror](#):
>
> Should this be added to the 2.5 roadmap?
I think we should start by surfacing this in the admin user page so you can see / add email addresses for 2.5. Maybe next after that add some rudimentary UX in the admin pages for merging users now that we have the well tested rake task.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [January 28, 2020, 2:45pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/8 "2020-01-28T14:45:02Z")
We’d have to validate each address right?
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [February 28, 2020, 9:11am UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/9 "2020-02-28T09:11:00Z")
> [@codinghorror](#):
>
> Why would Discourse accept a random email address, not matching any valid user account on the target site? 🤔
I’m still struggling to understand why Discourse trusts/validates the `From:` header when it can be so trivially spoofed?
The reply id header provides a useful validation as it’s unguessable/unknowable by bad guys.
Validating the `From:` header simply causes legitimate users to get confusing rejections to their post-by-email attempts if they happen to reply from a different email address (an edge case that’s more common than one would expect)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 28, 2020, 9:11am UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/10 "2020-02-28T09:11:46Z")
> [@ChrisBeach](#):
>
> legitimate users to get confusing rejections to their post-by-email attempts if they happen to reply from a different email address
Email is identity. A “different email address” is like saying “different DNA”.
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [February 28, 2020, 9:13am UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/11 "2020-02-28T09:13:21Z")
I have lots of email addresses, and so do some of my users.
I’m sincerely not trying to pick a fight here. I’m just slightly burnt by this issue as it contributed to a very important member of one of my forums choosing to no longer contribute to the forum
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 28, 2020, 9:14am UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/12 "2020-02-28T09:14:38Z")
Then you should be advocating for movement on the multiple email address setup per user, scroll up and do some reading perhaps?
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [February 28, 2020, 9:20am UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/13 "2020-02-28T09:20:00Z")
Unfortunately I don’t know if the proposed feature would solve the problem experienced on my Discourse instance.
In my case the user is the chairperson of a civic society. She had two email addresses and two Discourse accounts (one for each address). One account represented her personal identity, and other was for “official” posts on behalf of the civic society.
When she replied by email, she frequently did so from the “wrong” email address so her replies got rejected.
I assume the feature being discussed above would involve multiple email addresses per Discourse account, but would (naturally) disallow multiple Discourse accounts per email address. Thus it wouldn’t address my use case unfortunately.
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [February 28, 2020, 2:34pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/14 "2020-02-28T14:34:41Z")
> [@ChrisBeach](#):
>
> She had two email addresses and two Discourse accounts (one for each address). One account represented her personal identity, and other was for “official” posts on behalf of the civic society.
Couldn’t you just merge the accounts so one of the email addresses becomes a secondary?
If not, unfortunately there currently aren’t any tools in Discourse to help users remember which hat they are wearing.
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [February 28, 2020, 2:37pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/15 "2020-02-28T14:37:09Z")
> [@downey](#):
>
> Couldn’t you just merge the accounts so one of the email addresses becomes a secondary?
I could, from a technical point of view, but it is intentional that the user is able to post under two distinct identities (personal / on behalf of civic society)
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [February 28, 2020, 2:40pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/16 "2020-02-28T14:40:31Z")
Yeah. Sometimes people do get stuck in that scenario but I’d probably call it more of a corner case than an edge case 😄
Am I understanding right that this person effectively has two identities, but both of them are ending up in the same email account for some reason? If that’s true, it seems like they’d be running into this problematic scenario in more places than just Discourse. Maybe a job better suited for handling on the email client?
I have some work related aliases in my work email account, but the client matches the “from” address for replies to the address the mail was sent to…
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [February 28, 2020, 2:51pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/17 "2020-02-28T14:51:39Z")
I agree, it’s a corner case, and if she wasn’t such a prominent user it wouldn’t have been such a big deal.
In order to create two Discourse accounts, we used the [gmail dot hack](https://support.google.com/mail/answer/7436150?hl=en-GB) so she could create two email addresses for her gmail mailbox, in order that she could create two Discourse accounts.
When she replies by email to a post on the forum, gmail doesn’t necessarily use the same email address variant that Discourse expects.
IMO, provided the reply id is valid, Discourse should accept the reply.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [February 28, 2020, 6:23pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/18 "2020-02-28T18:23:01Z")
The dot hack is extremely fragile, and they’d likely be having a much better time with plus addressing instead.
>
If both accounts use a plus address and no accounts are on the bare address, the From: address switcher will work fine and forgetting to set it will simply mean the email is rejected instead of submitted on the wrong account.
Using + instead of dots also brings a lot of clarity to your filters, too 😅
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [May 6, 2020, 2:06pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/20 "2020-05-06T14:06:10Z")
> [@sam](#):
>
> I think we should start by surfacing this in the admin user page so you can see / add email addresses for 2.5.
@dan can you add that to your list?
---
### Author:  [@dan](https://meta.discourse.org/u/dan)
#### Post date: [May 19, 2020, 1:06pm UTC](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841/21 "2020-05-19T13:06:33Z")
I submitted a pull request to improve support for multiple email addresses:
[https://github.com/discourse/discourse/pull/9691](https://github.com/discourse/discourse/pull/9691)
[Next page](https://meta.discourse.org/t/confused-by-error-message-from-reply-by-email/139841.md?page=2)