I’m using the mail-receiver, and I recently configured the email_in_authserv_id setting with my forum’s processor.
I’m not sure if it’s hasn’t been working at all, but an email has just come through that should have been caught. Specifically, it is an email addressed to my forum’s support@ address (which goes to a PM for the admins), spoofed to be from that same address. Maybe because there is an existing staged account for that address the authentication-results is ignored?
Here are the top of the email headers as shown from within Discourse itself:
Authentication-Results: leaflet-mail-receiver.localdomain; dmarc=fail (p=none dis=none) header.from=intfiction.org
Authentication-Results: leaflet-mail-receiver.localdomain; dkim=none;
dkim-atps=neutral
Received-SPF: None (mailfrom) identity=mailfrom; client-ip=**********; helo=intfiction.org; envelope-from=support@intfiction.org; receiver=intfiction.org
Received: from intfiction.org (unknown [*************])
by leaflet-mail-receiver.localdomain (Postfix) with ESMTP id B62F1120746
for <support@intfiction.org>; Thu, 5 Nov 2026 11:53:25 +0000 (UTC)
From: Postmaster <support@intfiction.org>
To: support@intfiction.org
Subject: =?UTF-8?B?8J+TqSBJbmNvbWluZyBNZXNzYWdlcyBGYWlsdXJl?=
Date: 5 Nov 2026 03:53:24 -0800
My Discourse version: 2026.7.4.
I’m going to remove the staged user’s support@ email, which is currently a secondary email, as it shouldn’t ever be sending emails from that address (noreply@ is the email it actually sends from). Maybe that will help going forward.