| Internet-Draft | Wrong Recipient | August 2024 |
| Weekly | Expires 14 February 2025 | [Page] |
This document describes a mechanism for an email recipient to indicate to a sender that they are not the intended recipient.¶
This note is to be removed before publishing as an RFC.¶
The latest revision of this draft can be found at https://dweekly.github.io/ietf-wrong-recipient/draft-ietf-mailmaint-wrong-recipient.html. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-ietf-mailmaint-wrong-recipient/.¶
Discussion of this document takes place on the MAILMAINT Working Group mailing list (mailto:mailmaint@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/mailmaint/. Subscribe at https://www.ietf.org/mailman/listinfo/mailmaint/.¶
Source for this draft and an issue tracker can be found at https://github.com/dweekly/ietf-wrong-recipient.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 14 February 2025.¶
Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Many users with common names and/or short email addresses receive transactional emails from service providers intended for others. These emails can't be unsubscribed (as they are transactional) but neither are they spam. These emails commonly are from a noreply@ email address; there is no standards-based mechanism to report a "wrong recipient" to the sender. Doing so is in the interest of all three involved parties: the inadvertent recipient (who does not want the email), the sender (who wants to be able to reach their customer and who does not want the liability of transmitting PII to a third party), and the intended recipient.¶
This document specifies a structured mechanism for the reporting of such misdirected email via either HTTPS POST or email inbox, directly mirroring the List-Unsubscribe and List-Unsubscribe-Post mechanisms of [RFC2369] and [RFC8058] respectively.¶
If the Wrong-Recipient header field is present in an email message, and the message is determined to likely not be spam, the user can select an option to indicate that they are not the intended recipient, and the sender is notified.¶
Similar to one-click unsubscription [RFC8058], the mail service can perform this action in the background as an HTTPS POST to a provided URL without requiring the user's further attention to the matter. A mailto: URI may also be included for non-HTTP MUAs, akin to List-Unsubscribe from [RFC2369].¶
For example of when this might be used, suppose a cable TV provider enrolls a new subscriber over the phone. The agent enrolling the customer may accidentally enter the wrong email address for their customer. A month later, the provider sends a bill to this email address, which may be valid but belongs to the wrong person. The mechanism described here gives the inadvertent recipient a mechanism to notify the provider that they need to update their records.¶
Since it's possible the user may have a separate valid account with the sending service, it may be important that the sender be able to tie which email was sent to the wrong recipient. For this reason, the sender may also include an opaque blob in the header field to specify the account ID referenced in the email; this is included in the POST.¶
Note that this kind of misdelivery shouldn't be possible if a service has previously verified the user's email address for the account.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
Allow a recipient to stop receiving emails intended for someone else.¶
Allow a service to discover when they have the wrong email for a user.¶
This document does not propose a mechanism for automatically discovering whether a given user is the correct recipient of an email, though it is possible to use some of the signals in an email, such as the intended recipient name, to infer a possible mismatch between actual and intended recipients.¶
Mail Senders that wish to be notified when a misdelivery has occurred SHOULD include a Wrong-Recipient header field with an HTTPS URI to which the recipient's mail client can POST and/or a mailto: URI to which an email should be sent. If this header field is included, the mail sender MUST ensure these endpoints are valid for a period of at least one year after sending.¶
The sender MUST encode a mapping to the underlying account identifier in the URI in order to allow the service to know which of their accounts has an incorrect email.¶
The URI SHOULD include an opaque identifier or another hard-to-forge component in addition to, or instead of, the plaintext recipient email address and user ID in order to prevent a malicious party from exercising the endpoint on a victim's behalf. Possible examples include using a signature parameter to the URI or UUID with a sender-local database lookup to retrieve the email and user ID referenced.¶
When a mail client receives an email that includes a Wrong-Recipient header field, an option SHOULD be exposed in the user interface that allows a recipient to indicate that the mail was intended for another user, if and only if the email is reasonably assured to not be spam.¶
If the user selects this option, the mail client MUST perform an HTTPS POST to the first https URI in the Wrong-Recipient header field, or send an empty message to the first referenced mailto: address.¶
To minimize XSRF attacks, the POST request MUST NOT include cookies, HTTP authorization, or any other context information. The "wrong recipient" reporting operation is logically unrelated to any previous web activity, and context information could inappropriately link the report to previous activity.¶
The POST body MUST include only "Wrong-Recipient=true".¶
If the response is a HTTP 500 type error indicating server issue, the client MAY retry. If the HTTP response to the POST is a 200, the client MUST NOT retry. No feedback to the user as to the success or failure of this operation is proposed or required.¶
When a misdelivery has been indicated by a POST to the HTTPS URI or email to the given mailto: URI, the sender MUST make a reasonable effort to cease emails to the indicated email address for that user account.¶
The POST endpoint MUST NOT issue an HTTP redirect and SHOULD return a
200 OK status; the content body will be ignored.¶
Any GET request to the same URI MUST NOT be treated as an indication
of a wrong recipient notification, since anti-spam software may attempt
a GET request to URIs mentioned in mail headers without receiving user
consent. Senders MAY return an error 405 Method Not Allowed in
response to a GET request to the URI. The sender MAY elect
to present a page at this URI responsive to a GET request that
presents the user with a form that allows them to submit the POST.¶
The sender SHOULD make a best effort to attempt to discern a correct email address for the user account, such as by using a different known email address for that user, postal mail, text message, phone call, app push, or presenting a notification in the user interface of the service. How the sender should accomplish this task is not part of this specification.¶
The email needs at least one valid authentication identifier. In this version of the specification the only supported identifier type is DKIM [RFC6376], that provides a domain-level identifier in the content of the "d=" tag of a validated DKIM-Signature header field.¶
The Wrong-Recipient header field needs to be included in the "h=" tag of a valid DKIM-Signature header field.¶
The following ABNF imports fields and WSP from [RFC5322] and URI from [RFC3986]. An https URI, mailto URI, or one of each are permitted. Other URI protocols MUST NOT be used.¶
fields =/ wrong-recipient
wrong-recipient = "Wrong-Recipient:" 0*1WSP "<" URI ">"
*(0*1WSP "," 0*1WSP "<" URI ">") 0*WSP
¶
Header in Email:¶
Wrong-Recipient: <https://example.com/wrong-recipient?
uid=12345&email=user@example.org&sig=a29c83d>
¶
Resulting POST request:¶
POST /wrong-recipient?uid=12345&email=user@example.org&sig=a29c83d HTTP/1.1 Host: example.com Content-Length: 20 Wrong-Recipient=true¶
Header in Email:¶
Wrong-Recipient: <https://example.com/wrong-recipient?
uuid=c002bd9a-e015-468f-8621-9baf6fca12aa>
¶
Resulting POST request:¶
POST /wrong-recipient?uuid=c002bd9a-e015-468f-8621-9baf6fca12aa HTTP/1.1 Host: example.com Content-Length: 20 Wrong-Recipient=true¶
Header in Email:¶
Wrong-Recipient:
<https://example.com/wrong-recipient?
uuid=c002bd9a-e015-468f-8621-9baf6fca12aa>,
<mailto:wrong-recipient.c002bd9a-e015-468f-8621-9baf6fca12aa
@example.org>
¶
The Wrong-Recipient header field may contain the recipient address, but that is already exposed in other header fields like To.¶
The user ID of the recipient with the sending service may be exposed by the Wrong-Recipient URI, which may not be desired but a sender can instead use an opaque blob to perform a mapping to a user ID on their end without leaking any information to outside parties, such as the UUID examples given above.¶
A bad actor with access to the user's email could maliciously indicate the recipient was a Wrong Recipient with any services that used this protocol, causing mail delivery and potentially account access difficulties for the user.¶
The Wrong-Recipient POST provides a strong hint to the mailer that the address to which the message was sent was valid, and could in principle be used as a way to test whether an email address is valid. It also may expose the recipient's location and ISP via IP address. However, unlike passive methods like embedding tracking pixels, the mechanism proposed here takes an active user action. Nonetheless, MUAs ought only expose this Wrong Recipient option if relatively confident that the email is not spam.¶
A sender with a guessable URI structure and no use of either signed parameters or a UUID would open themselves up to a malicious party POST'ing email credentials for victims, potentially causing difficulty. Senders should be strongly encouraged to use a signature or opaque blob as suggested. No algorithm for creating such a signature or opaque blob is included in this standard since only the sender needs to validate the correctness of the hard-to-forge URL.¶
IANA has registered a new entry to the "Provisional Message Header Field Names" registry, to be made permanent if this proposal becomes a standard.¶
Header field name: Wrong-Recipient Protocol: mail Status: Provisional Author/Change controller: IETF Specification document(s): *** This document *** Related information: none¶
Many thanks to John Levine for helping shepherd this document as well as Oliver Deighton and Murray Kucherawy for their kind and actionable feedback on the language and first draft of the proposal. Thanks to Eliot Lear for helping guide the draft to the right hands for review. A detailed review by Jim Fenton was much appreciated and caught a number of key issues. Many thanks to the members of IETF ART for vigorous discussion thereof and for feedback from the new MAILMAINT working group chaired by Ken Murchison.¶