Launchpad Blog

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta name="description" content="Blog posts from the Launchpad team" /> <title>Launchpad Blog</title> <link href="https://blog.launchpad.net/wp-content/themes/launchpad/style.css" rel="stylesheet" type="text/css" /> <link rel="shortcut icon" href="https://launchpad.net/@@/launchpad" /> <script type="text/javascript" src="https://blog.launchpad.net/wp-content/themes/launchpad/js/mootools-1.2-core.js"></script> <script type="text/javascript" src="https://blog.launchpad.net/wp-content/themes/launchpad/js/funcs.js"></script> <script type="text/javascript"> var _gaq = _gaq || []; _gaq.push(['_setAccount', 'UA-12833497-3']); _gaq.push(['_trackPageview']); (function() { var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s); })(); </script> </head> <body>  <div id="header"> <a href="/wp-admin" style="float:right; top: 2px;">Log in</a> <div id="finder"> <input type="search" accesskey="s" value="Search blog archives" name="s" id="s" /> <input type="hidden" name="blog_url" id="blog_url" value="https://blog.launchpad.net" /> <a href="https://blog.launchpad.net/feed" title="RSS Feed for Blog Entries"><img src="https://blog.launchpad.net/wp-content/themes/launchpad/images/rss.png" alt="RSS Feed" /></a> </div> <h1><a href="https://blog.launchpad.net" class="header-link"><img src="https://blog.launchpad.net/wp-content/themes/launchpad/images/logo.png" /><span class="logotext"> launchpad</span><strong>blog</strong></a></h1> </div> <div id="content" class="widecolumn"> <div class="navigation"> « <a href="https://blog.launchpad.net/general/launchpad-news-march-2019-july-2019" rel="prev">Launchpad news, March 2019 – July 2019</a>     <a href="https://blog.launchpad.net/general/login-regression-for-users-with-non-ascii-names" rel="next">Login regression for users with non-ASCII names</a> » </div> <div class="post" id="post-4318"> <h2> <a href="https://blog.launchpad.net/notifications/bug-emails-now-use-the-bugs-address-in-the-from-header" rel="bookmark" title="Permanent Link: Bug emails now use the bug’s address in the From: header">Bug emails now use the bug’s address in the From: header</a> </h2> <div class="entry"> <p>The <code>From:</code> addresses used by Launchpad’s bug notifications have changed, to improve the chances of our messages being delivered over modern internet email.</p> <p>Launchpad sends a lot of email, most of which is the result of Launchpad users performing some kind of action. For example, when somebody adds a comment to a bug, Launchpad sends that comment by email to everyone who’s subscribed to the bug.</p> <p>Most of Launchpad was designed in an earlier era of internet email. In that era, it was perfectly reasonable to take the attitude that we were sending email on behalf of the user – in effect, being a fancy mail user agent or perhaps a little like a mailing list – and so if we generated an email that’s a direct result of something that a user did and consisting mostly of text they wrote, it made sense to put their email address in the <code>From:</code> header. <code>Reply-To:</code> was set so that replies would normally go to the appropriate place (the bug, in the case of bug notifications), but if somebody wanted to go to a bit of effort to start a private side conversation then it was easy to do so; and if email clients had automatic address books then those wouldn’t get confused because the address being used was a legitimate address belonging to the user in question.</p> <p>Of course, some people always wanted to hide their addresses for obvious privacy reasons, so since 2006 Launchpad has had a “Hide my email address from other Launchpad users” switch (which you can set on your <a href="https://launchpad.net/~/+edit">Change your personal details</a> page), and since 2010 Launchpad has honoured this for bug notifications, so if you have that switch set then your bug comments will be sent out as something like “<code>From: Your Name <bug-id@bugs.launchpad.net></code>“. This compromise worked tolerably well for a while.</p> <p>But spammers and other bad actors ruin everything, and the internet email landscape has changed. It’s reasonably common now for operators of email domains to publish <a href="https://en.wikipedia.org/wiki/DMARC"><abbr title="Domain-based Message Authentication, Reporting and Conformance">DMARC</abbr></a> policies that require emails whose From: headers are within that domain to be authenticated in some way, and this is incompatible with the older approach. As a result, it’s been getting increasingly common for Launchpad bug notifications not to be delivered because they failed these authentication checks. Regardless of how justifiable our notification-sending practices were, we have to exist within the reality of internet email as it’s actually deployed.</p> <p>So, thanks to a <a href="https://code.launchpad.net/~teward/launchpad/+git/launchpad/+merge/383643">contribution from Thomas Ward</a>, Launchpad now sends all its bug notifications as if the user in question had the “Hide my email address from other Launchpad users” switch set: that is, they’ll all appear as something like “<code>From: Your Name <bug-id@bugs.launchpad.net></code>“. Over time we expect to extend this sort of approach to the other types of email that we send, possibly with different details depending on the situation.</p> <p>Please <a href="https://help.launchpad.net/Feedback">let us know</a> if this causes any strange behaviour in your email client. We may not be able to fix all of them, depending on how they interact with DMARC’s requirements, but we’d like to be aware of what’s going on.</p> <p></p> <p>Tags: <a href="https://blog.launchpad.net/tag/email" rel="tag">email</a>, <a href="https://blog.launchpad.net/tag/front-page" rel="tag">front-page</a></p> <p class="postmetadata alt"> <small>This entry was posted by <strong>Colin Watson</strong> on Wednesday, May 20th, 2020 at 2:43 pm and is filed under <a href="https://blog.launchpad.net/category/notifications" rel="category tag">Notifications</a>. You can follow any responses to this entry through the <a href="https://blog.launchpad.net/notifications/bug-emails-now-use-the-bugs-address-in-the-from-header/feed">RSS 2.0</a> feed. You can <a href="#respond">leave a response</a>, or <a href="https://blog.launchpad.net/notifications/bug-emails-now-use-the-bugs-address-in-the-from-header/trackback" rel="trackback">trackback</a> from your own site. </small> </p> </div> </div>  <h3 id="comments">One Response to “Bug emails now use the bug’s address in the From: header”</h3> <ol class="commentlist"> <li class="alt" id="comment-694425"> <img alt='' src='https://secure.gravatar.com/avatar/009f7b73ca330e38ffa2534fef1706e2?s=32&d=blank&r=g' srcset='https://secure.gravatar.com/avatar/009f7b73ca330e38ffa2534fef1706e2?s=64&d=blank&r=g 2x' class='avatar avatar-32 photo' height='32' width='32' loading='lazy'/> <cite><a href='https://www.unix-ag.uni-kl.de/~auerswal/' rel='external nofollow ugc' class='url'>Erik Auerswald</a></cite> Says: <br /> <small class="commentmetadata"><a href="#comment-694425" title="">May 26th, 2020 at 9:37 am</a> </small> <p>First let me say that I agree with restricting the systems that may sent mail for a given domain. Thus I do think it is useful to have the bug system send using itself as sender address. But I think it is problematic to use the bug reporter’s name with an email address that is not that of the bug reporter, because this tends to confuse recipients. It also tends to confuse email clients (user types (part of) a real name, the email client finds the email address, but it may use launchpad’s address instead).</p> <p>So perhaps you could instead use something like<br /> “From: Launchpad on behalf of Your Name “?</p> <p>[I did experience people trying to send an email to me, but using a @github.com address, after they received an email via GitHub, although they had my correct email address already as well, so I do think this is a real problem.]</p> </li> </ol> <h3 id="respond">Leave a Reply</h3> <form action="https://blog.launchpad.net/wp-comments-post.php" method="post" id="commentform"> <p><input type="text" name="author" id="author" value="" size="22" tabindex="1" /> <label for="author"><small>Name </small></label></p> <p><input type="text" name="email" id="email" value="" size="22" tabindex="2" /> <label for="email"><small>Mail (will not be published) </small></label></p> <p><input type="text" name="url" id="url" value="" size="22" tabindex="3" /> <label for="url"><small>Website</small></label></p>  <p><textarea name="comment" id="comment" cols="100%" rows="10" tabindex="4"></textarea></p> <p><input name="submit" type="submit" id="submit" tabindex="5" value="Submit Comment" /> <input type="hidden" name="comment_post_ID" value="4318" /> </p> <p style="display: none;"><input type="hidden" id="akismet_comment_nonce" name="akismet_comment_nonce" value="bc4ee69e05" /></p><p style="display: none !important;"><label>Δ<textarea name="ak_hp_textarea" cols="45" rows="8" maxlength="100"></textarea></label><input type="hidden" id="ak_js_1" name="ak_js" value="233"/><script>document.getElementById( "ak_js_1" ).setAttribute( "value", ( new Date() ).getTime() );</script></p> </form> </div> <div id="footer"> <p> <a href="https://help.launchpad.net/Legal">Terms of use</a> | <a href="https://launchpad.net/feedback">Help improve Launchpad</a> | <a href="https://launchpad.net/faq">FAQ</a> </p> <p><a rel="license" href="http://creativecommons.org/licenses/by/2.0/uk/"> <span xmlns:dc="http://purl.org/dc/elements/1.1/" href="http://purl.org/dc/dcmitype/Text" property="dc:title" rel="dc:type">Launchpad Blog</span> by <a xmlns:cc="http://creativecommons.org/ns#" href="https://canonical.com/" property="cc:attributionName" rel="cc:attributionURL">Canonical Ltd</a> is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by/2.0/uk/">Creative Commons Attribution 2.0 UK: England & Wales License</a>. <img alt="Creative Commons License" style="border-width:0;vertical-align:middle;" src="https://i.creativecommons.org/l/by/2.0/uk/80x15.png" /></a></p> <p>© 2004-2019 <a href="https://canonical.com/" target="_blank">Canonical Limited.</a></p> </div>

CINXE.COM

Launchpad Blog