I have an app whose main purpose is to help people track emails they send.
In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret.
An alternative would be to create a mailto: link with a bcc: containing an email address that is the secret. e.g. firstname.lastname@example.org
We plan to implement the bcc: anyways. Assume the API used to read the emails includes info on DKIM/SPF verification.
Technically, does that validate the email address as well as clicking a link?
If the email doesn't include the DKIM/SPF info, my assumption is it could have been forged, so it's not complete enough to assume the email is validated.