roundcube / roundcubemail

The Roundcube Webmail suite
https://roundcube.net
GNU General Public License v3.0
5.8k stars 1.63k forks source link

Identity: split local and domain part of email address field #9482

Closed MiMoHo closed 3 months ago

MiMoHo commented 3 months ago

Prerequisites

Proposal

Serious web hosting companies block emails sent with an identity whose email address does not match the domain owned by the user. However, the warning message SMTP Error (553): Failed to add recipient "mail@example.com" (5.7.1 <mail@notmydomain.com>: Sender address rejected: not owned by user mail@mydomain.com). first appears after the user already clicked to send the email resulting in an error.

Motivation and context

To prevent false expectations and unnecessary errors it would be favorable to visualize which sender details are supported by splitting the identity's email address field into a local and domain part. The administrator shall be able to define in the installation settings if all arbitrary values for the domain are allowed or – to prevent spam – only those owned by the user which are to be selected from a drop-down list. If only one domain is supported, the field would not be a drop-down list but greyed out with the only possible domain while the local part remains always editable for multiple identities.

pabzm commented 3 months ago

Can you please specify concretely how you imagine the installation settings to work for admins? I imagine those to become very complicated – or of very limited use.

Also: why should we do this in the core of Roundcubemail?

There's the plugin hook identity_create, which could be used in a plugin to determine if a to-be-created identity may be saved (and thus be used as sender address). In custom code all kinds of rules may be checked without having to express them in a config file.

johndoh commented 3 months ago

dont forget about

// Set identities access level:
// 0 - many identities with possibility to edit all params
// 1 - many identities with possibility to edit all params but not email address
// 2 - one identity with possibility to edit all params
// 3 - one identity with possibility to edit all params but not email address
// 4 - one identity with possibility to edit only signature
$config['identities_level'] = 0;

as well

MiMoHo commented 3 months ago

@pabzm I can't explain that as I don't set up Roundcube myself but just comment from a user perspective. Currently, the service provider's installation let's me put in whatever email address I imagine in the identity which actually has to match the mailbox's domain as otherwise, I receive an error when trying to send the email. Hence, if I knew right away which options I actually have according to the limitations defined by the admin, it would be an error-free user experience thanks to an intuitive, visually distinctive input scheme.

pabzm commented 3 months ago

@MiMoHo Your initial description was very detailed, so I assumed you'd have thoughts on that.

So your actual wish is to restrict the creation and editing of identities, right? And splitting local and domain part of email addresses is just one implementation detail, that might be of help. Then please change the title of this issue accordingly.

I still think this should be implemented as a plugin, because all the tools and hooks are available for that. Maybe someone agrees and builds it.

alecpl commented 3 months ago

Usually in my experience there's a need to limit not the domains you can use there, but to limit entries to a precise list of email addresses. Users have aliases.

Roundcube does not know what aliases/addresses are available. It would have to fetch the list from somewhere. I've seen plugins that do this, but none of them I can recommend. I agree this is not a core feature.