Spam with from address set to reply by email address: The Discourse forum has been receiving spam emails with the “from” address set to its own “reply by email address” without the reply key part. This causes Discourse to send a “Rejection Mail” to itself, which is then rejected again. ryantm wonders if there’s a way to disable rejection emails for messages that don’t match the format of the “reply by email address”.
mpalmer suggests that the issue might be related to the “fast-rejection code” and that Discourse shouldn’t be rejecting the rejection email as it should be marked as auto-generated. ryantm shares that the To address on these emails is “forum-replies@example.com” and has made a pull request to address the issue.
The pull request was later merged by zogstrip, and ryantm is monitoring the situation to see if it resolves the problem.
Our “reply by email address” is “forum-replies+%{reply_key}@example.com”. Recently, we’ve started receiving spam with the from address set to “forum-replies@example.com”. When this happens, Discourse is sends a “Rejection Mail” to its own “reply by email address” (well, without the reply key part of course). After this, Discourse rejects the “Rejection Mail”, but thankfully the new “Rejection Mail” is sent to the “notification email”, which is what I’d guess Discourse uses as the From address for rejection mails.
Is there a way to turn off rejection emails for messages that do not match the format of the “reply by email address”?
What’s the To address on these e-mails? If Discourse is rejecting them, then it’s presumably an invalid recipient, in which case the fast-rejection code might need to be tweaked a little to catch whatever it is you’re seeing. That’ll stop Discourse sending a rejection back to itself, because it’ll never even see the message.
Discourse shouldn’t be rejecting the rejection e-mail, though, because the initial rejection should be marked as auto-generated, and we shouldn’t be responding to auto-generated mail. Presumably one of those "should"s isn’t true, which is a bug.
Otherwise, it’s reasonable that Discourse ignore e-mail sent to it from its own address; I can’t think of a legitimate circumstance in which that would happen.
Finally, it’s not a particularly good idea to disable rejections entirely for messages sent to mangled variations of the reply-to address; e-mail clients (and servers) are universally terrible, and do all manner of unspeakable things. Having a response back saying “everything is awful” is more user-friendly (in general) than blackholing mail.
. Hopefully that fixes it; I’ll continue to monitor it.