{"action":"created","issue":{"url":"https://api.github.com/repos/Sterc/FormIt/issues/101","repository_url":"https://api.github.com/repos/Sterc/FormIt","labels_url":"https://api.github.com/repos/Sterc/FormIt/issues/101/labels{/name}","comments_url":"https://api.github.com/repos/Sterc/FormIt/issues/101/comments","events_url":"https://api.github.com/repos/Sterc/FormIt/issues/101/events","html_url":"https://github.com/Sterc/FormIt/issues/101","id":173684835,"number":101,"title":"email field should be used in emailReplyTo, not emailFrom, to avoid rejected emails based on SPF/ DMARC violation","user":{"login":"yoleg","id":539742,"avatar_url":"https://avatars.githubusercontent.com/u/539742?v=3","gravatar_id":"","url":"https://api.github.com/users/yoleg","html_url":"https://github.com/yoleg","followers_url":"https://api.github.com/users/yoleg/followers","following_url":"https://api.github.com/users/yoleg/following{/other_user}","gists_url":"https://api.github.com/users/yoleg/gists{/gist_id}","starred_url":"https://api.github.com/users/yoleg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yoleg/subscriptions","organizations_url":"https://api.github.com/users/yoleg/orgs","repos_url":"https://api.github.com/users/yoleg/repos","events_url":"https://api.github.com/users/yoleg/events{/privacy}","received_events_url":"https://api.github.com/users/yoleg/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-08-29T02:27:10Z","updated_at":"2016-09-25T19:45:35Z","closed_at":"2016-09-25T19:45:35Z","body":"The default behavior of the FormIt email hook of setting the \"from\" address as the \"email\" form field causes failure of contact form emails when they are sent to email providers that reject or greylist SPF/ DMARC failures, such as gmail. \r\n \r\n**Severity:** \r\n\r\n- This problem only happens for certain form submissions (e.g. from aol.com users) and when using certain providers (e.g. gmail), so it can take a long time to realize it is happening. By that time, you have lost several form submissions. \r\n- What's worse, no error is logged to the MODX error log or shown during the form submission (at least for certain mail server configurations), and you usually must have root access to view mail logs to even see this problem\r\n- If your mail server is properly configured to send the reject mail back to the form submitter, they get to see your (possibly private) email address.\r\n- If you're lucky, some user might be able to contact you some other way to tell you about the reject message. Otherwise, you might never know about the failures. \r\n \r\n**Note**: I have been monitoring my exim logs over the last few weeks for several clients, and I have verified several lost contact form submissions already!\r\n \r\n**Backgound**: SPF is a public domain policy (published via DNS TXT records) that lists the servers that are allowed to send mail with a \"from\" address from that domain. Spam often uses fake \"from\" addresses and usually fails SPF validation, so many email providers reject or greylist mail that fails SPF. DMARC is an additional policy that recommends what to do with SPF or DKIM failures of email \"from\" that domain.\r\n \r\n**Example 1**: A user fills out a FormIt contact form with the email address \"someone@aol.com\". The contact form sends the email to the emailTo addresss, which is the admin's gmail address. aol.com has recently implemented a DMARC policy of \"reject\" for SPF failures. Because the email says \"from\" aol.com but this web server is not listed in aol's SPF record of allowed servers, SPF validation fails, and GMail honors aol's policy to reject SPF failures by rejecting the email. The email to the admin fails, possibly with a failure notification sent to \"someone@aol.com\" IF the mail server is configured to do so. \r\n \r\n**Example 2:** A user fills out a FormIt contact form with the email address \"someone@gmail.com\". The contact form sends the email to the emailTo addresss, which is hosted with Zoho Mail. The admins have configured Zoho Mail to reject SPF violations to reduce spam, since Zoho Mail does not support DMARC. The email fails SPF validation, because gmail.com's SPF policy does not allow THIS web server to send mail \"from\" gmail.com. The local server's retry timeout expires, and the email to the admin fails, possibly with a failure notification sent to \"someone@gmail.com\" IF the mail server is configured to do so.\r\n \r\n**Proposed Solution:** The _default_ behavior should be changed to be as follows:\r\n\r\n- &emailFrom - If not set, use the emailsender system setting\r\n- &emailFromName - If not set, the site_name system setting (or perhaps leave empty)\r\n- &emailReplyTo - If not set, first look for an `email` form field. If none is found, leave empty.\r\n \r\nThis way, the email will still be easy to \"reply to\". The emailsender is likely already set to an address that is allowed to send from this server. Even if it is not, the SPF/ DMARC failures would be CONSISTENT, and thus easier to detect during initial testing. "},"comment":{"url":"https://api.github.com/repos/Sterc/FormIt/issues/comments/249442245","html_url":"https://github.com/Sterc/FormIt/issues/101#issuecomment-249442245","issue_url":"https://api.github.com/repos/Sterc/FormIt/issues/101","id":249442245,"user":{"login":"joeke","id":2332231,"avatar_url":"https://avatars.githubusercontent.com/u/2332231?v=3","gravatar_id":"","url":"https://api.github.com/users/joeke","html_url":"https://github.com/joeke","followers_url":"https://api.github.com/users/joeke/followers","following_url":"https://api.github.com/users/joeke/following{/other_user}","gists_url":"https://api.github.com/users/joeke/gists{/gist_id}","starred_url":"https://api.github.com/users/joeke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joeke/subscriptions","organizations_url":"https://api.github.com/users/joeke/orgs","repos_url":"https://api.github.com/users/joeke/repos","events_url":"https://api.github.com/users/joeke/events{/privacy}","received_events_url":"https://api.github.com/users/joeke/received_events","type":"User","site_admin":false},"created_at":"2016-09-25T19:45:35Z","updated_at":"2016-09-25T19:45:35Z","body":"Version 2.2.11 is out: https://modx.com/extras/package/formit"}}
{"actor":{"display_login":"joeke"}}