Clemens85 / runningdinner

Mono-Repo containing Java backend, React Frontend and Lambdas
https://runyourdinner.eu
MIT License
3 stars 2 forks source link

Links in emails have a different link target than text, causes warning in mail client #65

Closed danleh closed 1 month ago

danleh commented 4 months ago

When registering for a demo event I created at runyourdinner.eu (just to try it out), the emails from runyourdinner@mail.runyourdinner.eu contain links where the link text (e.g., https://runyourdinner.eu/running-dinner-events/abcdef.../activate) doesn't match the actual link target and instead go through https://u3158000.ct.sendgrid.net/ls/click?upn=....

Unfortunately, this causes some mail clients (e.g., Mozilla Thunderbird) to warn users when clicking on the link. This in turn could lead to some people not confirming their registration. (Besides, it would also be great if the data only goes to runyourdinner.eu, not SendGrid as a third party, but that's a minor point.)

I guess this is beacuse you use SendGrid as the outbound mail server. Could you use some other mail server (or change something in the SendGrid configuration) to not rewrite link targets?

danleh commented 4 months ago

Stackoverflow gives two options for turning off SendGrid link tracking: https://stackoverflow.com/questions/40687027/sendgrid-change-href-of-link

A) Add clicktracking="off" to each link individually, so I guess that would require parsing the HTML of simpleMessage.getText() and adding this attribute to all hrefs, serializing again and then passing on to https://github.com/Clemens85/runningdinner/blob/146a02cf881bc5f9c3c88b3b82e7234037704a68/runningdinner-backend/src/main/java/org/runningdinner/mail/sendgrid/SendGridMailWrapper.java#L55.

B) (simpler, but global): Disabling click tracking in your SendGrid settings as per https://docs.sendgrid.com/ui/account-and-settings/tracking.

Clemens85 commented 4 months ago

Also firstly thanks for pointing that out, I wasn't aware of the link-tracking.

Your issue contains actually two respectively three issues:

  1. Linktracking behavior: I will check if I can turn this off in SendGrid, I don't want to use tracking anyways.

  2. Actually I have setup domain authentication with SendGrid (DKIM / SPF), so that the emails should be sent from the runyourdinner.eu domain. I will however also check that, maybe something changed on SendGrid's side and it is not any longer valid. This is quite crucial, because it is anyway needed for trustfully sending emails.

  3. Sending mails in general / other mail servers: This is a quite complicated topic. Principally you have two options for sending mails: Either you use an own Email SMTP server (something like googlemail, yahoo, web.de, ...) or your use an Email (cloud) service like SendGrid (or AWS SES, Mailchimp, ...). Some years ago I used an own SMTP server (and I even allowed users to bring in their own SMTP server). This worked however not very well, traditional SMTP mail servers have most often some rate limits or other limitations which cause problems when sending multiple customized mails in a batch from a web application. On the other way, Email services like SendGrid don't have these limitations, because they are designed for doing so. And they offer also some more advanced features like offering APIs for detecting blocked Emails etc. This works quite well and also most professional enterprises use such services for sending mails. There are however 2 drawbacks of such services:

    • They typically need to be paid for what you send. With SendGrid I have a free tier which is for now enough to handle the monthly volume of sending mails.
    • Not every mail provider's postbox trust such services, especially when they are used within the free tier (like I do). Setting up domain authentication helps (see above), but for being really 100% trusted, you should also setup so called dedicated IPs for sending mails, but this causes additional costs (besides the actual infrastructure costs) that I am not able to pay due to I offer runyourdinner completely free.

So long story short: I am not 100% happy with SendGrid, but currently if offers for me the best service for handling sending mails. I am however very open if there exist better solutions. Speaking generally, sending emails is anyway not the best option, I also evaulated in the past if it would be possible to (additionally) send messages by using other channels like WhatsApp or Telegram or even SMS. But for doing so I would again need to incorporate another service that causes costs, and I am trying to keep the costs to a minimum.

danleh commented 4 months ago

Thanks a lot for the additional explanations! Using a third-party service totally makes sense, I know the hassle of running your own mailserver (especially outbound) and making sure it has a good reputation, mails are not blocked, DKIM, SPF, etc.

Regarding link tracking: Perfect, if you are also fine without the tracking, I guess the global setting (option B above) is the best way to fix this. Let me know if I can help with any testing.

Regarding costs: If the free tier shouldn't suffice at some point, please let us know! We used runyourdinner.eu already in the past for a couple of running dinner events, so I'll ask around if we could contribute a little, if this helps you out. (We can continue this via email as well.)

Clemens85 commented 3 months ago

I deactivated link tracking in SendGrid, so thanks again for pointing that out. I will check soon if DKIM / SPF is still properly setup

danleh commented 3 months ago

Perfect, thanks for the quick fix! :)

danleh commented 1 month ago

Seems fixed, so closing to clean up :)