Case should not be respected for email addresses

@ghartwig,

Case absolutely should matter for the name part of the email address. It is a ratified internet email standard. See RFC2822 for the standards.

Thanks. OK, I’ve read through that RFC but don’t see anything explicit about handling the address, except:

The local-part portion is a domain dependent string. In addresses, it is simply interpreted on the particular host as a name of a particular mailbox.

It sort of implies that it should be left to the domain to interpret but doesn’t explicitly say it.

I’ve never encountered an email system where case mattered, but I guess it could be possible.

People often capitalize portions of their email addresses causing a mismatch if they don’t enter it the same when trying to unsubscribe. Would it be possible to pass the email address to the unsubscribe page, so they don’t have to enter it and possibly enter it incorrectly?

@ghartwig,

Actually the document and section you need is here:

https://tools.ietf.org/html/rfc5321#section-2.4

“The local-part of a mailbox MUST BE treated as case sensitive.”

Passing an email address to your site to unsubscribe still won’t get around the issue if the address is type incorrectly and it also opens a route for third parties to start unsubscribing your readers just by knowing their email address.

There isn’t an easy solution.

Ah, there we go. Interesting.

Passing the address would ensure that what was subscribed would be the same thing passed to unsubscribe, but I understand the security problem.

OK, thanks for your consideration.

@ghartwig,

One thing you can do is add some text to the footer of your notification email directing users to the unsubscribe form that also tells them to copy the email address from their notification email, that will be identical to what Subscribe2 holds in the database.

I am pondering a ‘strict’ mode that can be turned off where desired but I’ll need to see how much code this would need.