# Tasto Rispondi / verifica indirizzo email non funzionante? (risposte via email)
**URL:** https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507
**Category:** Support
**Created:** [17 Dicembre 2018, 11:24pm UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507 "2018-12-17T23:24:28Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [17 Dicembre 2018, 11:24pm UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/1 "2018-12-17T23:24:28Z")
I have set the following:
However, a user’s email reply was rejected as their sending email address didn’t match the account email address.
In this case I’d like their email reply to be accepted.
Is there anything I can change to ensure email replies are accepted in cases where the sender email address doesn’t match the account email address?
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [18 Dicembre 2018, 1:01am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/2 "2018-12-18T01:01:31Z")
Make sure the `enable_staged_users` site setting is enabled.
For categories, enabling “Accept emails from anonymous users with no accounts” in the category’s settings should work.
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [18 Dicembre 2018, 1:06am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/3 "2018-12-18T01:06:25Z")
Thanks @gerhard.
“Enable staged users” was in fact enabled already. In my case, the user has two accounts on the forum, both live. She replied to a notification from the “other” account and it got rejected by Discourse.
I’ve noticed also that the wording on the setting is a little ambiguous. “Only use reply key” suggests in my mind “don’t additionally validate email address” - but then the setting description says that disabling the setting allows user impersonation. I’ll try disabling the setting and see if that helps.
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [18 Dicembre 2018, 1:10am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/4 "2018-12-18T01:10:05Z")
Was it a reply to a public topic or a group message? The exact error would be interesting too. You can find it in Admin → Emails → Rejected. The second account might not be allowed to reply to the topic.
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [18 Dicembre 2018, 1:11am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/5 "2018-12-18T01:11:36Z")
The reply was to a public forum post
> [@gerhard](#):
>
> The exact error would be interesting too
We’re sorry, but your email message to [“hitreply+[redacted]@se26.life”] (titled Re: SE26.life [Dining/Drinking] Zigghy Cafe [Now open]) didn’t work.
> [@](#):
>
> Your reply was sent from a different email address than the one we expected, so we’re not sure if this is the same person. Try sending from another email address, or [contact a staff member](https://se26.life/about).
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [18 Dicembre 2018, 1:20am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/6 "2018-12-18T01:20:12Z")
Disabling that setting isn’t a good idea.
Email addresses are always validated. Each reply key is bound to a topic and user. If they do not match, the email gets rejected. There’s only one exception. If the system knows that an email was forwarded to another user, because that other user was in the `To` or `CC` header of a previous reply, than it will allow that user to reply with the forwarded reply key.
In your case, the user needs to send with the correct email address. There’s no way around it. Most email clients should be smart enough to select the right sender address anyway.
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [18 Dicembre 2018, 1:23am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/7 "2018-12-18T01:23:54Z")
> [@gerhard](#):
>
> In your case, the user needs to send with the correct email address. There’s no way around it. Most email clients should be smart enough to select the right sender address anyway.
Thanks for the explanation.
I would be comfortable with just the reply key being used to authorise the user.
After all, it’s easy to spoof an email address isn’t it?
---
### Author:  [@manuc](https://meta.discourse.org/u/manuc)
#### Post date: [20 Marzo 2019, 10:05am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/8 "2019-03-20T10:05:45Z")
Hi,
I have the same problem, a user has two accounts registered, one with her email as @googlemail.com and one as @gmail.com
The result is that sometimes her emails get rejected with the error:
> Your reply was sent from a different email address than the one we expected, so we’re not sure if this is the same person.
I have a few other users replying by email and it only happens to this user, so I assume it’s the gmail/googlemail domain mismatch.
I am thinking of adding the alternate domain email as secondary email address on both accounts, or is there a better idea?
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [20 Marzo 2019, 10:12am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/9 "2019-03-20T10:12:26Z")
> [@manuc](#):
>
> I am thinking of adding the alternate domain email as secondary email address on both accounts, or is there a better idea?
There are no other _safe_ alternatives. Handling this automatically would definitely lead to security issues.
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [20 Marzo 2019, 10:14am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/10 "2019-03-20T10:14:30Z")
> [@zogstrip](#):
>
> Handling this automatically would definitely lead to security issues.
Isn’t it a security issue for Discourse to trust the email address in the From header, and to use this as part of its validation of incoming emails? I can set the From header to whatever I like.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [20 Marzo 2019, 10:16am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/11 "2019-03-20T10:16:14Z")
That’s why we have reply keys 😉
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [20 Marzo 2019, 10:24am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/12 "2019-03-20T10:24:03Z")
Indeed! 😀
The reply key is what protects us from spoofed replies to notification emails. The email address listed in the From field doesn’t offer any real protection at all.
Forgive me for repeating the point, but including email address in the validation of replies is causing user-affecting usability issues and should be dropped IMO
---
### Author:  [@manuc](https://meta.discourse.org/u/manuc)
#### Post date: [20 Marzo 2019, 10:54am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/13 "2019-03-20T10:54:32Z")
Well I ventured into the Rails console (for the first time!) to add a secondary email address, but my workaround to add the @googlemail.com email to the @gmail.com account and viceversa didn’t work, because the emails have already been taken, of course it makes sense.
If anyone has other ideas to fix this reply by email issue, I’ll be grateful, as I generally am for being able to use Discourse.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [20 Marzo 2019, 10:57am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/14 "2019-03-20T10:57:55Z")
> [@manuc](#):
>
> because the emails have already been taken
You could merge the users (provided they’re the same user).
---
### Author:  [@manuc](https://meta.discourse.org/u/manuc)
#### Post date: [20 Marzo 2019, 11:02am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/15 "2019-03-20T11:02:06Z")
You’re right, I’ll look into that, cheers.
---
### Author:  [@ChrisBeach](https://meta.discourse.org/u/ChrisBeach)
#### Post date: [13 Novembre 2019, 6:09pm UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/16 "2019-11-13T18:09:45Z")
> [@manuc](#):
>
> Bene, ho provato per la prima volta a entrare nella console di Rails per aggiungere un indirizzo email secondario, ma il mio workaround per aggiungere l’indirizzo @googlemail.com all’account @gmail.com e viceversa non ha funzionato, perché gli indirizzi email erano già stati presi. Ovviamente ha senso.
Potresti dirmi cosa hai fatto per far funzionare questa cosa? Sto ancora avendo problemi con Discourse che rifiuta email legittime inviate da utenti tramite email. È molto frustrante dover spiegare questo problema agli utenti interessati.
Alla fine, preferirei di gran lunga poter semplicemente _disabilitare il controllo_ che Discourse esegue sull’indirizzo email delle email in arrivo (che è **fallibile** contro lo spoofing degli indirizzi email e **inutile** , dato che viene verificata la chiave di risposta).
---
### Author:  [@manuc](https://meta.discourse.org/u/manuc)
#### Post date: [14 Novembre 2019, 8:27am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/17 "2019-11-14T08:27:54Z")
Non credo di averlo risolto davvero, ma è passato un po’ di tempo e potrei avere la memoria che mi gioca brutti scherzi.
Ho provato ad aggiungere l’indirizzo email secondario come spiegato qui:
> [@Additional email address per user account support](https://meta.discourse.org/t/additional-email-address-per-user-account-support/59847/32):
>
> @LeoMcA thank you so much for the work on this change. It made possible for my company to integrate our products with the community without having to deal with merging or deleting stuff.
ma non ha funzionato perché gli indirizzi email erano già stati utilizzati.
Penso che la soluzione sarebbe stata unire gli account utente, anche se non ho mai proceduto perché ho semplicemente parlato con l’utente e da allora ha utilizzato solo uno dei due account, quindi non posso dirti come sarebbe andata nella pratica, scusa.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [9 Agosto 2023, 3:43am UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/18 "2023-08-09T03:43:42Z")
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [11 Settembre 2023, 12:43pm UTC](https://meta.discourse.org/t/reply-key-email-address-check-not-working-replies-by-email/104507/19 "2023-09-11T12:43:10Z")