Act on a reply only when its address token and authentication match

How to do it

Apps that turn replies into comments, tickets or approvals act on mail anyone can forge. Put a random or signed token in the reply address, such as reply+t8f2c4a@in.example.com, that names the thread and the person. Read Authentication-Results (RFC 8601) added by your own receiving server, never by earlier hops. Check that the From address belongs to the person the token names. Strip quoted text and signatures before you store the body, and treat the body as untrusted input, as Resist indirect prompt injection says. Hold any reply that fails for a person to review, and never run an approval from it.

Examples

JavaScript example

export function acceptReply(message, { verifyToken, ownAuthServer }) {
  const thread = verifyToken(message.to.split('+')[1]?.split('@')[0]);
  const results = message.headers.authenticationResults.find(header => header.startsWith(ownAuthServer));
  if (!thread || !results?.includes('dmarc=pass')) return null;
  return thread.participants.includes(message.from.toLowerCase()) ? thread : null;
}

Python example

def accept_reply(message, verify_token, own_auth_server: str):
    local = message.to.split("@")[0]
    thread = verify_token(local.split("+", 1)[1]) if "+" in local else None
    results = next((h for h in message.authentication_results if h.startswith(own_auth_server)), "")
    if thread is None or "dmarc=pass" not in results:
        return None
    return thread if message.sender.lower() in thread.participants else None

How to check

A test posts an inbound message with a valid token but dmarc=fail. Nothing is added to the thread. A second test with a forged token and a passing DMARC result is also refused, and a genuine reply posts once without the quoted history.

Sources

• RFC 8601, Message Header Field for Indicating Message Authentication Status

Related rules

• APS-83 Resist indirect prompt injection in Application security