Hi there, Discourse by default sends a summary of the post body in the new post notification emails for Watched threads. I’m wondering if that could cause problems if a few spam posts with links get past the other safeguards, which would get re-transmitted via email to the users watching the thread. In that case it seems likely that some users would mark those emails as spam, thus hurting the reputation of the domain / IP. In practice has anybody seen this happen?
AI-generated summary
In a discussion titled ‘Problems with notifications emails for spam posts?’, rahim123 raises concerns that Discourse’s default behavior of including post body summaries in email notifications for watched threads could inadvertently propagate spam links to users, potentially leading them to mark such emails as spam and harm the sender’s domain/IP reputation. pfaffman responds that if this were a widespread issue, the behavior would likely have been changed already, suggesting users generally trust their community and wouldn’t flag such emails as spam. However, rahim123 counters that users often confuse forum notifications with direct emails — citing instances where users replied to personal messages sent via noreply@ because they saw full message content in the notification — and argues it’s plausible they’d reflexively mark spam-containing notifications as spam without thinking. They also note that Bayesian spam filters might automatically penalize the sender’s domain/IP upon detecting spam links in email bodies, compounding the risk. The discussion highlights a potential vulnerability in how Discourse handles email notifications and user behavior around them, especially when spam slips through moderation.
If many had, it would have been changed.
I suspect that people trust their community and are not likely to mark messages from their community as spam even if they would mark the post as spam on the forum.
Hmmm. I’m seeing that users are having a hard time differentiating between direct emails and email notifications about forum content. I’ve seen several replies to personal messages in my noreply@ address inbox because they saw the entire PM content in the notification and handled it like a normal email reply. (I don’t have replies via email enabled in Discourse.) So it seems fairly likely that those users will see a spam link and without thinking twice hit the spam button. Also I’m assuming the Bayesian spam filters that the providers run will also see links to spam domains in the email body, so they might even automatically ding the sending domain/IP reputation.