Adding a Wrong Recipient URL for Handling Misdirected Emails

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 20 August 2024.¶

Copyright Notice

Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

Many users with common names and/or short email addresses receive transactional emails from service providers intended for others. These emails can't be unsubscribed (as they are transactional) but neither are they spam. These emails commonly are from a noreply@ email address; there is no standards-based mechanism to report a "wrong recipient" to the sender. Doing so is in the interest of all three involved parties: the inadvertent recipient (who does not want the email), the sender (who wants to be able to reach their customer and who does not want the liability of transmitting PII to a third party), and the intended recipient.¶

This document proposes a structured mechanism for the reporting of such misdirected email via either HTTPS POST or email inbox, directly mirroring the List-Unsubscribe and List-Unsubscribe-Post mechanisms of [RFC2369] and [RFC8058] respectively.¶

2. Proposal

There ought be a mechanism whereby a service can indicate it has an endpoint to indicate a "wrong recipient" of an email. If this header field is present in an email message, the user can select an option to indicate that they are not the intended recipient.¶

Similar to one-click unsubscription [RFC8058], the mail service can perform this action in the background as an HTTPS POST to the provided URL without requiring the user's further attention to the matter. A mailto: URI may also be included for non-HTTP MUAs, akin to List-Unsubscribe from [RFC2369].¶

Since it's possible the user may have a separate valid account with the sending service, it may be important that the sender be able to tie which email was sent to the wrong recipient. For this reason, the sender may also include an opaque blob in the header field to specify the account ID referenced in the email; this is included in the POST.¶

Note that this kind of misdelivery shouldn't be possible if a service has previously verified the user's email address for the account.¶

3. Conventions and Definitions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

4. High-Level Goals

Allow a recipient to stop receiving emails intended for someone else.¶

Allow a service to discover when they have the wrong email for a user.¶

5. Out of Scope

This document does not propose a mechanism for automatically discovering whether a given user is the correct recipient of an email, though it is possible to use some of the signals in an email, such as the intended recipient name, to infer a possible mismatch between actual and intended recipients.¶

6. Implementation

7. Additional Requirements

The email needs at least one valid authentication identifier. In this version of the specification the only supported identifier type is DKIM [RFC6376], that provides a domain-level identifier in the content of the "d=" tag of a validated DKIM-Signature header field.¶

The Wrong-Recipient header field needs to be included in the "h=" tag of a valid DKIM-Signature header field.¶

8. Header Syntax

The following ABNF imports fields and WSP from [RFC5322] and URI from [RFC3986]. An https URI, mailto URI, or one of each are permitted. Other URI protocols MUST NOT be used.¶

fields =/ wrong-recipient

wrong-recipient = "Wrong-Recipient:" 0*1WSP "<" URI ">"
    *(0*1WSP "," 0*1WSP "<" URI ">") 0*WSP

9. Examples

Wrong-Recipient: <https://example.com/wrong-recipient?
    uid=12345&email=user@example.org&sig=a29c83d>

POST /wrong-recipient?uid=12345&email=user@example.org&sig=a29c83d HTTP/1.1
Host: example.com
Content-Length: 20

Wrong-Recipient=true

Wrong-Recipient: <https://example.com/wrong-recipient?
    uuid=c002bd9a-e015-468f-8621-9baf6fca12aa>

POST /wrong-recipient?uuid=c002bd9a-e015-468f-8621-9baf6fca12aa HTTP/1.1
Host: example.com
Content-Length: 20

Wrong-Recipient=true

Wrong-Recipient:
    <https://example.com/wrong-recipient?
        uuid=c002bd9a-e015-468f-8621-9baf6fca12aa>,
    <mailto:wrong-recipient.c002bd9a-e015-468f-8621-9baf6fca12aa
        @example.org>

10. Security Considerations

The Wrong-Recipient header field may contain the recipient address, but that is already exposed in other header fields like To:.¶

The user ID of the recipient with the sending service may be exposed by the Wrong-Recipient URI, which may not be desired but a sender can instead use an opaque blob to perform a mapping to a user ID on their end without leaking any information to outside parties, such as the UUID examples given above.¶

A bad actor with access to the user's email could maliciously indicate the recipient was a Wrong Recipient with any services that used this protocol, causing mail delivery and potentially account access difficulties for the user.¶

The Wrong-Sender POST provides a strong hint to the mailer that the address to which the message was sent was valid, and could in principle be used as a way to test whether an email address is valid. It also may expose the recipient's location and ISP via IP address. However, unlike passive methods like embedding tracking pixels, the mechanism proposed here takes an active user action. Nonetheless, MUAs ought only expose this Wrong Recipient option if relatively confident that the email is not spam.¶

A sender with a guessable URI structure and no use of either signed parameters or a UUID would open themselves up to a malicious party POST'ing email credentials for victims, potentially causing difficulty. Senders should be strongly encouraged to use a signature or opaque blob as suggested. No algorithm for creating such a signature or opaque blob is included in this standard since only the sender needs to validate the correctness of the hard-to-forge URL.¶

11. IANA Considerations

IANA has registered a new entry to the "Provisional Message Header Field Names" registry, to be made permanent if this proposal becomes a standard.¶

Header field name: Wrong-Recipient
Protocol: mail
Status: Provisional
Author/Change controller: IETF
Specification document(s): *** This document ***
Related information: none

Acknowledgments

Many thanks to John Levine for helping shepherd this document as well as Oliver Deighton and Murray Kucherawy for their kind and actionable feedback on the language and first draft of the proposal. Thanks to Eliot Lear for helping guide the draft to the right hands for review. A detailed review by Jim Fenton was much appreciated and caught a number of key issues. Many thanks to the members of IETF ART for vigorous discussion thereof.¶

Author's Address