List-Unsubscribe email header makes it possible to recipient to automatically unsubscribe from the mailing list:
List-Unsubscribe: <mailto:[email protected]?subject=unsubscribe&body=qwe>
Free email service we build adds the "Unsubscribe" button in the UI, which will trigger sending a email to [email protected] with specified body and subject. And it will be sent from the email of the recipient (out user). And signed with DKIM.
An attacker can send a email to our user, which, in case of pressing 'unsubscribe' button, will send a fake mail with given body, and from our user, signed by our DKIM.
How is it possible to protect from this?
We can forbid processing our emails in List-Unsubscribe header (Protecting our users from receiving such fake emails).
But what to do in case when 3rd party mail provider sends us such header? How can we protect our users from sending fake emails? (Sent from our network, and protected by DKIM and SPF)
Or is it a problem and responsibility of 3rd party email services, not to sent emails with malicious List-Unsubscribe header?