# Reply own mail creates new topic
**URL:** https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519
**Category:** Support
**Created:** [November 21, 2017, 3:14pm UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519 "2017-11-21T15:14:09Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@gwmngilfen](https://meta.discourse.org/u/gwmngilfen)
#### Post date: [November 21, 2017, 3:14pm UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519/1 "2017-11-21T15:14:09Z")
(This might be a feature request rather than a bug, depending on your view…)
Consider the following chain of events:
- A user enabled with Mailing List mode enabled, but excluding own posts
- User sends in a new topic by mail (say, to [support@discourse.my.org](mailto:support@discourse.my.org)), obviously a new topic is created
- No email is sent back to the user due to their settings
- User now sends a second mail in
- The only mail in their email client is the original one in Sent, as no other mail has arrived
- This also goes to [support@discourse.my.org](mailto:support@discourse.my.org)
- Creates another new thread instead of appending to the first one
Given that the second mail will have an In-Reply-To header of the first mail, is it possible to detect that these should be on the first thread?
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [November 21, 2017, 3:45pm UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519/2 "2017-11-21T15:45:47Z")
By default Discourse needs to reply to a special email address that contains a reply key. The reply key is generated when Discourse sends you a notification about a new post and it is only valid for you 1) and that specific post. That’s how Discourse verifies that you are who you claim to be (because nobody else should have access to that reply key) and it also knows to which post you are replying.
Such an email address looks like this: `support+148425ef5b96ce547e9d79fb3b605760@example.com`
Without a reply key, Discourse assumes that you want to create a new topic.
**But** , there is a site setting which allows you to change that behaviour. Discourse will try to find related posts by Message-ID when you disable `find_related_post_with_key` in the settings.
⚠ There is a reason why that setting is enabled by default. Disabling it makes incoming emails a little bit less secure.
I’d say this is neither a bug nor a feature request 😉
* * *
1) There is one exception to that rule. When you reply to Discourse using a reply key and include other users via `To` or `CC`, Discourse knows about that and allows incoming emails using the same reply key from those users.
---
### Author:  [@gwmngilfen](https://meta.discourse.org/u/gwmngilfen)
#### Post date: [November 21, 2017, 4:25pm UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519/3 "2017-11-21T16:25:06Z")
Aha, so there is a setting, interesting. I see it says “WARNING: disabling this allows user impersonation based on email address” - how does this happen? Presumably it’s some kind of header shenanigans?
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [November 21, 2017, 5:28pm UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519/4 "2017-11-21T17:28:53Z")
> **[Email spoofing](https://en.wikipedia.org/wiki/Email_spoofing)**
>
> Email spoofing is the creation of email messages with a forged sender address. The term applies to email purporting to be from an address which is not actually the sender's; mail sent in reply to that address may bounce or be delivered to an unrelated party whose identity has been faked. Disposable email address or "masked" email is a different topic, providing a masked email address that is not the user's normal address, which is not disclosed (for example, so that it cannot be harvested), bu Th...
---
### Author:  [@gwmngilfen](https://meta.discourse.org/u/gwmngilfen)
#### Post date: [November 22, 2017, 9:38am UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519/5 "2017-11-22T09:38:40Z")
Right, I’m aware of spoofing the From header, but I feel I’m still missing a piece of the puzzle so apologies if I’m dragging this out. How does the use of a dedicated To address (reply+token@myinstance) help detect / block From header forgery? Or to put it another way, how does checking the message-id enable that vector?
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [November 22, 2017, 9:50am UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519/6 "2017-11-22T09:50:13Z")
It doesn’t prevent spoofing of the From header. But the reply key is like a secret that is only known by Discourse and you.
Every email sent by Discourse uses a different key. So, unless someone gains access to your emails or you forward the key to someone, nobody should be able to send an email to Discourse and successfully pretend to be you.
---
### Author:  [@gwmngilfen](https://meta.discourse.org/u/gwmngilfen)
#### Post date: [November 22, 2017, 9:51am UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519/7 "2017-11-22T09:51:28Z")
Ah, the key is unique per recipient rather than per post? _That’s_ the piece I was missing. Thanks!
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [November 22, 2017, 9:59am UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519/8 "2017-11-22T09:59:26Z")
It’s actually unique per email sent (so unique per recipient **and** post).
---
### Author:  [@gwmngilfen](https://meta.discourse.org/u/gwmngilfen)
#### Post date: [November 22, 2017, 10:03am UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519/9 "2017-11-22T10:03:05Z")
Ugh, yes, I got that but my comment is misleading :). Thanks for clarifying!
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 8, 2024, 12:43pm UTC](https://meta.discourse.org/t/reply-own-mail-creates-new-topic/74519/10 "2024-06-08T12:43:52Z")
This topic was automatically closed after 2390 days. New replies are no longer allowed.