---
title: "Act on a reply only when its address token · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/inbound-mail-and-replies/verify-inbound-replies
id: EML-78
level: Recommended
applies: email
updated: 2026-10-27
build: a2a6bdfed830
tokens: 986
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Act on a reply only when its address token and authentication match

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Inbound mail and replies](https://agentwranglers.se/playbook/email/inbound-mail-and-replies.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: EML-78
- Level: Recommended
- Chapter: [Inbound mail and replies](https://agentwranglers.se/playbook/email/inbound-mail-and-replies.md)
- Rule: Give each thread a reply address with a signed token. Act on a reply only when the token is valid and your own server's `Authentication-Results` show DMARC pass for the expected sender.
- Check: A test posts an inbound message with a valid token but `dmarc=fail`. Nothing is added to the thread. A second test with a forged token and a passing DMARC result is also refused, and a genuine reply posts once without the quoted history.
- Applies when: The project sends email.
- How: Apps that turn replies into comments, tickets or approvals act on mail anyone can forge. Put a random or signed token in the reply address, such as `reply+t8f2c4a@in.example.com`, that names the thread and the person. Read `Authentication-Results` (RFC 8601) added by your own receiving server, never by earlier hops. Check that the `From` address belongs to the person the token names. Strip quoted text and signatures before you store the body, and treat the body as untrusted input, as [Resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md) says. Hold any reply that fails for a person to review, and never run an approval from it.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export function acceptReply(message, { verifyToken, ownAuthServer }) {
  const thread = verifyToken(message.to.split('+')[1]?.split('@')[0]);
  const results = message.headers.authenticationResults.find(header => header.startsWith(ownAuthServer));
  if (!thread || !results?.includes('dmarc=pass')) return null;
  return thread.participants.includes(message.from.toLowerCase()) ? thread : null;
}
```

### Python example

```python
def accept_reply(message, verify_token, own_auth_server: str):
    local = message.to.split("@")[0]
    thread = verify_token(local.split("+", 1)[1]) if "+" in local else None
    results = next((h for h in message.authentication_results if h.startswith(own_auth_server)), "")
    if thread is None or "dmarc=pass" not in results:
        return None
    return thread if message.sender.lower() in thread.participants else None
```

## Sources

- [RFC 8601, Message Header Field for Indicating Message Authentication Status](https://www.rfc-editor.org/rfc/rfc8601)

## Related rules

- APS-83 [Resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/email/inbound-mail-and-replies/verify-inbound-replies">Agent Wranglers email playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Accept mail at postmaster and abuse](https://agentwranglers.se/playbook/email/inbound-mail-and-replies/postmaster-abuse.md)
- Next: [Send automatic replies only to mail from people](https://agentwranglers.se/playbook/email/inbound-mail-and-replies/auto-reply-loops.md)
- [Inbound mail and replies](https://agentwranglers.se/playbook/email/inbound-mail-and-replies.md)