Interesting solution…
But what if the ROT13 translation is happening in a way that’s not visible to the users?
That’s what we believe is happening. Because when they forward the email to us the link looks correct. When they look at it, the link looks correct.
Our assumption is that the anti-virus / security bot is checking each link in an email, but not changing the links for the user.
Here’s a case for what we think is happening:
A user gets an email with links in it. One of those links is an unsubscribe link, the kind you see at the bottom of a lot of email newsletters. The security bot’s job is to make sure none of the links go to malware or phishing sites so it needs to follow the links to the domains they link to (and any domains it’s redirected to). But the security bot needs to do all of this without actually unsubscribing the user because the user didn’t click the usubscribe link, it was the bot that checked the link. So the bot ROT13 transforms all the query parameter values (like the email address) and then follows the links. If it lands on a malware site it blocks the email. If it lands on legitimate sites it allows the email to go through to the user including all of the un-transformed links so that the user can decide which links to click on.
But in our case the link is one-time use so when the security bot checks it the link it creates the ROT13 account and when it passes the link on to the user the link is all used up.
Our user will see the right email in the params and would see “ok” in the params, but since the link was one use only it’s already used up.