Fake email messages via List-Unsubscribe header

Question

List-Unsubscribe email header makes it possible to recipient to automatically unsubscribe from the mailing list:

List-Unsubscribe: <mailto:list@host.com?subject=unsubscribe&body=qwe>

Free email service we build adds the "Unsubscribe" button in the UI, which will trigger sending a email to list@host.com with specified body and subject. And it will be sent from the email of the recipient (out user). And signed with DKIM.

An attacker can send a email to our user, which, in case of pressing 'unsubscribe' button, will send a fake mail with given body, and from our user, signed by our DKIM.

How is it possible to protect from this?

We can forbid processing our emails in List-Unsubscribe header (Protecting our users from receiving such fake emails).

But what to do in case when 3rd party mail provider sends us such header? How can we protect our users from sending fake emails? (Sent from our network, and protected by DKIM and SPF)

Or is it a problem and responsibility of 3rd party email services, not to sent emails with malicious List-Unsubscribe header?

Answer 1

Most implementers of unsubscribe buttons do not honour the "subject" and "body" parameters, for exactly the reason you give. Those that do, only do it in response to validated emails, and where the domain of the unsubscribe email address matches the domain of the validated sender email address.

Essentially, you need to implement a policy for when the List-Unsubscribe header should be trusted.

Only if:

• You have validated the sender domain via SPF or DomainKeys, or matching round-trip DNS or another method.

AND

• The List-Unsubscribe domain matches the sender domain.

Even then you should only trust the Subject and body if you have whitelisted the sender domain.

Better - if the list is listname@example.com:

List-Unsubscribe: <mailto:listname-unsubscribe@example.com>

Best - each recipient should have a unique subscription ID:

List-Unsubscribe: <mailto:listname-unsubscribe-927349872392343@example.com>

Or some VERP thing:

• https://en.wikipedia.org/wiki/Variable_envelope_return_path