# Mailgun API密钥检查回溯（退信由邮件接收器处理时无需API密钥）

**URL:** https://meta.discourse.org/t/mailgun-api-key-check-backward-no-api-key-should-be-required-if-bounces-handled-by-mail-receiver/305909
**Category:** Bug
**Created:** [2024年四月29日 13:42 UTC](https://meta.discourse.org/t/mailgun-api-key-check-backward-no-api-key-should-be-required-if-bounces-handled-by-mail-receiver/305909 "2024-04-29T13:42:14Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [2026年二月24日 15:55 UTC](https://meta.discourse.org/t/mailgun-api-key-check-backward-no-api-key-should-be-required-if-bounces-handled-by-mail-receiver/305909/3 "2026-02-24T15:55:41Z")

</div>

在调查此问题时，我注意到我们只对 Mailgun 进行了问题检查。因此，我做了一些小的重构，添加了一个全局的“邮件反弹处理”问题检查，它将适用于我们配置的所有邮件提供商。

> <https://github.com/discourse/discourse/pull/38028>
>
> The \`MissingMailgunApiKey\` problem check had inverted logic: it warned admins wh…en \`reply\_by\_email\_enabled\` was true (meaning the mail receiver handles bounces via VERP, so no webhook API key is needed), but stayed silent when it was false (meaning bounces aren't being tracked at all). This caused false warnings on sites using the mail-receiver container.
> 
> This commit replaces the Mailgun-only check with a general \`EmailBounceHandling\` check that covers all supported email providers (Mailgun, SendGrid, Mailjet, Mandrill, Postmark, SparkPost, Mailpace, AWS SES). The check now correctly returns \`no\_problem\` when both \`reply\_by\_email\_enabled\` is true \*\*AND\*\* a VERP-capable reply address is configured, since bounces are handled by the mail receiver in that case.
> 
> For providers that previously accepted unauthenticated webhooks with only a log warning (SendGrid, Mailjet, Mandrill, Postmark, SparkPost), the behavior is preserved but upgraded to a Discourse.deprecate call (since 2026.2, drop 2026.5) to signal that authentication will be enforced in a future release.
> 
> Additionally:
> \- Adds Mailpace webhook signature verification (was previously missing)
> \- Adds the mailpace\_verification\_key site setting
> \- Includes a migration to clean up orphaned \`problem\_check\_trackers\` rows from the old \`missing\_mailgun\_api\_key\` check
> 
> https://meta.discourse.org/t/305909

---

_[View the full topic](https://meta.discourse.org/t/mailgun-api-key-check-backward-no-api-key-should-be-required-if-bounces-handled-by-mail-receiver/305909)._