[Django] #35365: Add RFC 3824 Auto-Submitted header to emails by default

[Django]

#35365: Add RFC 3824 Auto-Submitted header to emails by default
-------------------------------------------+------------------------
Reporter: Tobias Bengfort | Owner: nobody
Type: Uncategorized | Status: new
Component: Core (Mail) | Version: 5.0
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------------+------------------------
RFC 3824 (https://www.rfc-editor.org/rfc/rfc3834) defines the `Auto-
Submitted` header for emails to avoid mail loops. The vast majority of
mails sent by Django should use `Auto-Submitted: auto-generated`. The only
exceptions I can think of are:

- Django is used in a bigger system that also receives emails. In that
case it may also be appropriate to use `Auto-Submitted: auto-replied` in
some cases.
- Django is used to implement an email client. In that case `Auto-
Submitted` should not be used.

Since these are rare exceptions, I think Django should use `Auto-
Submitted: auto-generated` by default. Users who need more control should
have to explicitly disable this behavior.

I did not do a larger survey, but just from the mails I currently have in
my inbox I noticed that gitlab and unattended-upgrades both use `Auto-
Submitted`.
--
Ticket URL: <https://code.djangoproject.com/ticket/35365>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#35365: Add RFC 3824 Auto-Submitted header to emails by default

---------------------------------+------------------------------------

Reporter: Tobias Bengfort | Owner: nobody

Type: New feature | Status: new
Component: Core (Mail) | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

---------------------------------+------------------------------------
Changes (by Sarah Boyce):

* cc: Florian Apolloner, Russell Keith-Magee (added)
* stage: Unreviewed => Accepted
* type: Uncategorized => New feature
* version: 5.0 => dev

Comment:

Hi Tobias, thank you for this!
Accepting as this sounds like the right thing to do to me. Added a couple
of people in cc in case they have any concerns and can update the ticket
accordingly.
--
Ticket URL: <https://code.djangoproject.com/ticket/35365#comment:1>

[Django]

#35365: Add RFC 3824 Auto-Submitted header to emails by default
---------------------------------+------------------------------------
Reporter: Tobias Bengfort | Owner: nobody
Type: New feature | Status: new
Component: Core (Mail) | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------

Comment (by Adam Johnson):

I found very few search results about the header
([https://duckduckgo.com/?t=ffab&q=%22auto-
submitted%22+email+header&ia=web DuckDuckGo],
[https://www.google.com/search?hl=en&q=%22auto%2Dsubmitted%22%20email%20header#ip=1
Google]). Notably, I don’t see any “Email best practices” articles
discussing this header.

But on GitHub code search there are [https://github.com/search?q=%22auto-
submitted%22+%22auto-
generated%22&type=code&repo=&langOverride=&start_value=1 11.4k results]
for `"auto-submitted" "auto-generated"`, among which I found these tools:

* Wagtail since 2018:
https://github.com/wagtail/wagtail/blob/1ec62a6c2d99365886e41c517d386d8d36fa5d50/docs/releases/2.3.rst?plain=1#L39)
* Mastodon sets this header:
https://github.com/mastodon/mastodon/blob/1ad119941ff672b93f2b04dc29f82443349bb69c/app/mailers/application_mailer.rb#L21
* Bugzilla: https://github.com/mozilla-
bteam/bmo/blob/8192fe39ea8b93a7f3bd16fec4807e5d349ce223/Bugzilla/Mailer.pm#L100

It seems reasonable that Django would set it. But there’s some risk since
some search results are people trying to *remove* the header
([https://www.reddit.com/r/techsupport/comments/6sld0g/how_do_stop_my_email_headers_containing/
1], [https://stackoverflow.com/questions/34855722/how-to-remove-header-
auto-submitted-auto-generated-in-exchange-2013 2]). I think we should at
least document a way to opt-out, possibly by subclassing `EmailMessage`
and overriding `message()` to delete the header.
--
Ticket URL: <https://code.djangoproject.com/ticket/35365#comment:2>

[Django]

#35365: Add RFC 3824 Auto-Submitted header to emails by default
---------------------------------+------------------------------------

Reporter: Tobias Bengfort | Owner: cgracin
Type: New feature | Status: assigned

Component: Core (Mail) | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------

Changes (by cgracin):

* owner: nobody => cgracin
* status: new => assigned

--
Ticket URL: <https://code.djangoproject.com/ticket/35365#comment:3>

[Django]

#35365: Add RFC 3824 Auto-Submitted header to emails by default
---------------------------------+------------------------------------
Reporter: Tobias Bengfort | Owner: cgracin
Type: New feature | Status: assigned
Component: Core (Mail) | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------
Changes (by cgracin):

* has_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/35365#comment:4>

[Django]

#35365: Add RFC 3824 Auto-Submitted header to emails by default
---------------------------------+------------------------------------
Reporter: Tobias Bengfort | Owner: cgracin
Type: New feature | Status: assigned
Component: Core (Mail) | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------

Comment (by cgracin):

Hello everyone! I'm a new contributor here and just submitted a PR for
this feature. I went ahead and added the default behavior to the
EmailMessage class to attach the "Auto-Submitted : auto-generated" header.
I took the advice of Adam and.created a subclass of EmailMessage named
NoAutoSubmittedHeaderEmailMessage that removes the "Auto-Submitted : auto-
generated" header to allow a user to opt-out of this default behavior.
--
Ticket URL: <https://code.djangoproject.com/ticket/35365#comment:5>

[Django]

#35365: Add RFC 3824 Auto-Submitted header to emails by default
---------------------------------+------------------------------------
Reporter: Tobias Bengfort | Owner: cgracin
Type: New feature | Status: assigned
Component: Core (Mail) | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------

Comment (by Tobias Bengfort):

Thanks for the patch! I am not sure if
''NoAutoSubmittedHeaderEmailMessage'' is the best option though. The way I
understood Adam we should ''document'' how to create such a class, not
provide it in Django itself. Either way, having to use a different Message
class is a bit awkward because you can no longer use ''send_mail()''. My
proposal would be to add a setting ''DEFAULT_EMAIL_HEADERS'' which would
be more flexible. I cannot think of any other headers for which this could
be useful right now, but who knows. I am not sure whether we want another
setting though.
--
Ticket URL: <https://code.djangoproject.com/ticket/35365#comment:6>

[Django]

#35365: Add RFC 3824 Auto-Submitted header to emails by default
---------------------------------+------------------------------------
Reporter: Tobias Bengfort | Owner: cgracin
Type: New feature | Status: assigned
Component: Core (Mail) | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------

Changes (by Sarah Boyce):

* needs_better_patch: 0 => 1

Comment:

I am also not a fan of `NoAutoSubmittedHeaderEmailMessage` as a user would
need to make many updates to their code (including overwriting the
`EmailMultiAlternatives`, `mail_admins` etc).
I can see the appeal of having something like a `DEFAULT_EMAIL_HEADERS`
setting, however we try to avoid adding new setting to Django when we can.
We'd need very strong agreement that this is the best way forward here.
I would recommend creating a discussion on the
[https://forum.djangoproject.com/c/internals/5 forum] to try and get input
from a wider audience as to what would be the best approach.
--
Ticket URL: <https://code.djangoproject.com/ticket/35365#comment:7>