[Case 16578] Get serious about getting subaddress (plus addressing) support with exim

[soundguy]

FWIW, I have no interest in this whatsoever and I really don't see any advantage to it. All you have to do to enable complex routing is create a forwarder to dump a new address into an existing POP3 account and then set filters in the local client. I use several dozen forwarders dumping into an "unlisted" main account. I have a few hundred folders in my mail client and incoming mail is conditionally routed according to sender, destination, and subject.

[rs-freddo]

If i want to know when pizza hut sells my email address i just setup an email address pizzahut@ and sign up to pizzahut with that email address. I been doing that for years, interesting to note who does sell or lose my email address. Seems to me this adds complexity with very little value.

[DomineauX]

i don't understand your dictionary attack concern. if a spammer targets bob@domain.com, what difference would it make if they sent a thousand emails to bob@ or one to bob+1@ and another to bob+2@, etc. not to mention, i have never seen a piece of spam mail that used a subaddress. the feature is so minimally used that it doesn't make any sense for a spammer to target it.

if a spammer targets a subaddress, that subaddress can be easily null routed without affecting the main mailbox.

I know this is an old thread, but I just had to point this out.

If CPanel built this "feature" in, then it would quickly become so common that spammers would jump all over it.

The simplest answer is just do what so many others have been doing for a long time. Add "forwarders" like:

bob-pizzahut -> bob@example.com
bob-dominos -> bob@example.com
bob-pappajohns -> bob@example.com
bob-littleceasers -> bob@example.com

Then if bob-pizzahut@example.com starts getting spam, don't bother null routing it, just delete that alias then those mails will no longer be accepted.

ps. Apologies to anyone named Bob at example.com for all the spam you must get from folks like us abusing your address. But then you should have seen it coming, much like bill@microsoft.com!

[cPanelDavidG]

Here's a report I'm planning to file with our developers regarding this thread. Please let me know if I missed anything or if you have any final input before I send this to our developers.

Subaddressing (plus addressing) support

Subaddressing (also called plus addressing) allows for a person to create their own email aliases ad-hoc as needed in real time. The way this works is email user david@example.com would supply a party with an email address of: david+(arbitrary_string_of_characters)@example.com. This arbitrary string of characters following the + symbol would still need to be compliant with RFCs governing valid email addresses.

Scenario: Let's say I don't trust Google. I can signup to a Google service using the email address david+google@example.com. I do not set up david+google@example.com ahead of time, instead, I am just using my existing email address of david@example.com and adding +google to the user (before @) portion of the email address, arbitrarily. The power of this is I can eventually set up mail rules based on mail being sent to this specific email address.

Email sent to a "plus address," by default, is delivered normally. So emailing david@example.com is identical to emailing david+something@example.com. If users want email sent to a folder when it is sent to a plus address, they are welcome to create their own email filters to accomplish this. To make this process easier, a mail filtering option of "has subaddress" should be implemented.

Other characters are sometimes used to designated subaddressing, such as the period, hash and double-dash. In this implementation, only the plus sign (+) can designate subaddressing. RFC 5233 has no formal recommendations for separation characters.

The System administrator (root) must have the ability to enable or disable this functionality. By default, this functionality should be disabled thus be opt-in.

This functionality will have known limitations:
- Spammers can simply ignore the plus address provided to them and use +anything (or just your raw email address) to contact you.
- MUAs (mail applications and webmail programs) are not currently designed with this functionality in mind. This will result in responses coming from your main email address rather than the preferred subaddress, unless you have modified your MUA appropriately to accommodate this.

[cPanelDavidG]

I have filed the above report with our developers. If they need any further clarification or have any questions, followups will be posted to this thread.

[Miraenda]

If CPanel built this "feature" in, then it would quickly become so common that spammers would jump all over it.

I can't agree with this statement. There were prior discussions already in this thread why this isn't the case. Google's gmail has been doing this for years and spammers haven't jumped all over it yet. Gmail has a tremendously large user base. If you think about it, the spammer is only trying to find your real account, so using sub addressing serves no additional benefit to them. Once they find your bob@example.com account, they are going to spam it. They don't need to use bob+another@example.com in this instance. They've found your real account. Dictionary attacks are using words that the spammers hope will result in finding a real account to spam. Once they find that real account, using sub addressing would result in no additional benefits that I could see.

The point of the request is to be able to have these emails created "on the fly" when you are filling out a form somewhere for your email address without having to log in somewhere else to create these addresses. They are discardable addresses you create whenever needed somewhere that can then still route to your inbox (you probably don't even want to use that email address later on).

The whole idea is for simplicity and laziness. You can be lazy with sub addressing by only creating these email accounts (myname+pizzahut@mydomain.com) on the fly when filling out a form, then never have to deal later on with creating the real account. We all fill out so many forms, I certainly would appreciate the ability to have an email address created on the fly like this where I can then track down which company sold my email address later on (and discard those emails if I want) without having to individually create the address for every single company for every single form that I fill out.

Anyone who doesn't want to use it, wouldn't have to turn it on to use. I'm not certain why people wouldn't want to use it, though, if it helps simplify things for their users. I think if more people understood how it worked, they'd be more interested in implementing it.

[DomineauX]

I can't agree with this statement. There were prior discussions already in this thread why this isn't the case. Google's gmail has been doing this for years and spammers haven't jumped all over it yet. Gmail has a tremendously large user base. If you think about it, the spammer is only trying to find your real account, so using sub addressing serves no additional benefit to them. Once they find your bob@example.com account, they are going to spam it. They don't need to use bob+another@example.com in this instance. They've found your real account. Dictionary attacks are using words that the spammers hope will result in finding a real account to spam. Once they find that real account, using sub addressing would result in no additional benefits that I could see.

The point of the request is to be able to have these emails created "on the fly" when you are filling out a form somewhere for your email address without having to log in somewhere else to create these addresses. They are discardable addresses you create whenever needed somewhere that can then still route to your inbox (you probably don't even want to use that email address later on).

The whole idea is for simplicity and laziness. You can be lazy with sub addressing by only creating these email accounts (myname+pizzahut@mydomain.com) on the fly when filling out a form, then never have to deal later on with creating the real account. We all fill out so many forms, I certainly would appreciate the ability to have an email address created on the fly like this where I can then track down which company sold my email address later on (and discard those emails if I want) without having to individually create the address for every single company for every single form that I fill out.

Anyone who doesn't want to use it, wouldn't have to turn it on to use. I'm not certain why people wouldn't want to use it, though, if it helps simplify things for their users. I think if more people understood how it worked, they'd be more interested in implementing it.

I see your point and am convinced that it would indeed be handy. I would rather be able to do make up aliases on the fly so I would use it if implemented.

[cPanelKenneth]

I can't agree with this statement. There were prior discussions already in this thread why this isn't the case. Google's gmail has been doing this for years and spammers haven't jumped all over it yet. Gmail has a tremendously large user base. If you think about it, the spammer is only trying to find your real account, so using sub addressing serves no additional benefit to them. Once they find your bob@example.com account, they are going to spam it. They don't need to use bob+another@example.com in this instance. They've found your real account. Dictionary attacks are using words that the spammers hope will result in finding a real account to spam. Once they find that real account, using sub addressing would result in no additional benefits that I could see.

The point of the request is to be able to have these emails created "on the fly" when you are filling out a form somewhere for your email address without having to log in somewhere else to create these addresses. They are discardable addresses you create whenever needed somewhere that can then still route to your inbox (you probably don't even want to use that email address later on).

The whole idea is for simplicity and laziness. You can be lazy with sub addressing by only creating these email accounts (myname+pizzahut@mydomain.com) on the fly when filling out a form, then never have to deal later on with creating the real account. We all fill out so many forms, I certainly would appreciate the ability to have an email address created on the fly like this where I can then track down which company sold my email address later on (and discard those emails if I want) without having to individually create the address for every single company for every single form that I fill out.

Anyone who doesn't want to use it, wouldn't have to turn it on to use. I'm not certain why people wouldn't want to use it, though, if it helps simplify things for their users. I think if more people understood how it worked, they'd be more interested in implementing it.

That's a very nice explanation, thank you.

[rocksolidhq]

Figured i'd throw my vote in here too. I'd love to see this added.

From what i see this has been a request for 3 years now though i see that its "filed with the developers". What does that mean? Is there a light at the end of this long tunnel?

thanks,
dean

[neoboi]

+123455554 to this feature request.

[vexil]

I managed to get this working in a way that won't get destroyed when cpanel updates. I did this by editing the file /etc/init.d/exim so that each time before exim restarts, it will add in the required config settings to enable email subaddressing.

Here is the code you need:

function enableEmailSubAddressing() {
    sections="central_filter mainacct_central_user_filter central_user_filter virtual_user_filter virtual_aliases_nostar virtual_user_spam virtual_user virtual_aliases system_aliases local_aliases userforward"
    if [ ! -f /etc/exim.conf.pre-subaddressing-backup ]; then
        cp /etc/exim.conf /etc/exim.conf.pre-subaddressing-backup
    fi
    for section in $sections; do
        perl -i -e "undef \$/; \$_=<>; s/\n$section:\n\s*driver\s?=\s?(.*)\n/\n$section:\n  driver = \1\n  local_part_suffix = +*\n  local_part_suffix_optional\n/g; print" /etc/exim.conf
    done
}

# See how we were called.
case "$1" in
  start)
    # Start daemons.
    if [ "`grep -c 'local_part_suffix = +\*' /etc/exim.conf`" == "0" ]; then
        echo "Email subaddressing not enabled, altering /etc/exim.conf to enable it..."
        enableEmailSubAddressing
    fi

I just got this working and haven't spent long testing it so let me know if someone tries it and it causes problems. I'm not sure how compatible it is with filters and forwarding.

[Fral-IT]

Awesome! Thanks, vexil. I will test it, and if anything does not work will let you know.

Cpanel developers: please do add this feature, updating my config every day after the automated update is making me crazy.