I have set the following:
However, a user’s email reply was rejected as their sending email address didn’t match the account email address.
In this case I’d like their email reply to be accepted.
Is there anything I can change to ensure email replies are accepted in cases where the sender email address doesn’t match the account email address?
Make sure the enable_staged_users site setting is enabled.
For categories, enabling “Accept emails from anonymous users with no accounts” in the category’s settings should work.
Thanks @gerhard.
“Enable staged users” was in fact enabled already. In my case, the user has two accounts on the forum, both live. She replied to a notification from the “other” account and it got rejected by Discourse.
I’ve noticed also that the wording on the setting is a little ambiguous. “Only use reply key” suggests in my mind “don’t additionally validate email address” - but then the setting description says that disabling the setting allows user impersonation. I’ll try disabling the setting and see if that helps.
Was it a reply to a public topic or a group message? The exact error would be interesting too. You can find it in Admin → Emails → Rejected. The second account might not be allowed to reply to the topic.
The reply was to a public forum post
We’re sorry, but your email message to [“hitreply+[redacted]@se26.life”] (titled Re: SE26.life [Dining/Drinking] Zigghy Cafe [Now open]) didn’t work.
Disabling that setting isn’t a good idea.
Email addresses are always validated. Each reply key is bound to a topic and user. If they do not match, the email gets rejected. There’s only one exception. If the system knows that an email was forwarded to another user, because that other user was in the To or CC header of a previous reply, than it will allow that user to reply with the forwarded reply key.
In your case, the user needs to send with the correct email address. There’s no way around it. Most email clients should be smart enough to select the right sender address anyway.
Thanks for the explanation.
I would be comfortable with just the reply key being used to authorise the user.
After all, it’s easy to spoof an email address isn’t it?
Hi,
I have the same problem, a user has two accounts registered, one with her email as @googlemail.com and one as @gmail.com
The result is that sometimes her emails get rejected with the error:
Your reply was sent from a different email address than the one we expected, so we’re not sure if this is the same person.
I have a few other users replying by email and it only happens to this user, so I assume it’s the gmail/googlemail domain mismatch.
I am thinking of adding the alternate domain email as secondary email address on both accounts, or is there a better idea?
There are no other safe alternatives. Handling this automatically would definitely lead to security issues.
Isn’t it a security issue for Discourse to trust the email address in the From header, and to use this as part of its validation of incoming emails? I can set the From header to whatever I like.
That’s why we have reply keys 
Indeed! 
The reply key is what protects us from spoofed replies to notification emails. The email address listed in the From field doesn’t offer any real protection at all.
Forgive me for repeating the point, but including email address in the validation of replies is causing user-affecting usability issues and should be dropped IMO
Well I ventured into the Rails console (for the first time!) to add a secondary email address, but my workaround to add the @googlemail.com email to the @gmail.com account and viceversa didn’t work, because the emails have already been taken, of course it makes sense.
If anyone has other ideas to fix this reply by email issue, I’ll be grateful, as I generally am for being able to use Discourse.
You could merge the users (provided they’re the same user).
You’re right, I’ll look into that, cheers.
이 문제를 해결하기 위해 어떤 조치를 취하셨는지 알려주실 수 있을까요? 저는 여전히 사용자가 이메일로 작성한 게시글을 Discourse가 거부하는 문제로 어려움을 겪고 있습니다. 해당 사용자에게 이 문제를 설명하는 것이 매우 답답합니다.
결국, 수신되는 이메일의 이메일 주소를 Discourse가 검사하는 검사 기능을 비활성화할 수 있다면 훨씬 좋겠습니다. (이것은 주소 위장에 취약하며, 불필요합니다. 왜냐하면 응답 키가 이미 확인되므로.)
정말 해결했는지는 잘 모르겠어요. 시간이 좀 지났고, 제 기억이 정확하지 않을 수도 있거든요.
여기서 설명된 대로 보조 이메일 주소를 추가해 보았지만:
이메일 주소가 이미 사용 중이어서 작동하지 않았습니다.
해결책은 사용자를 병합하는 것이었을 거라고 생각해요. 하지만 진행하지 않았는데, 해당 사용자와 직접 이야기해 보니 이후로 계정 중 하나만 사용하고 있더라고요. 그래서 실제로 병합이 어떻게 작동했을지 말씀드리기 어렵네요. 죄송합니다.
