Skip to content

Verify bounces before acting on them; refresh the dashboard GIF - #27

Merged
heminjoshi merged 2 commits into
mainfrom
bounce-verification
Oct 17, 2026
Merged

heminjoshi merged 2 commits into
mainfrom
bounce-verification

Conversation

@heminjoshi

Copy link
Copy Markdown
Collaborator

Any message that looked like a bounce (a mailer-daemon sender, an
"Undeliverable" subject) counted toward the bounce rate even when it
matched nothing Franco sent, so a few spoofed messages could trip the kill
switch, and delay notices were treated as hard failures.

  • parse_bounce(): recipients from RFC 3464 Final-/Original-Recipient (or
    the addresses in the text) and permanence from Status 5.x.x vs 4.x.x or
    delay wording; referenced_ids(): In-Reply-To and References.
  • Handler acts only on a report that matches a sent outbox row (by
    Message-ID, or an address emailed in the last 14 days), names that row's
    recipient, is permanent, and hasn't been counted; otherwise it logs
    bounce_ignored and changes nothing. The SMTP adapter now passes
    References/Content-Type/Auto-Submitted headers.
  • tests/test_bounces.py: real Gmail and RFC 3464 reports, References and
    recent-send matching, spoofed reports, wrong recipient, old sends,
    delays, double counting.
  • scripts/record_demo.py seeds researched accounts (campaign, owner,
    score, sourced observation), M1/F1 campaigns in preview and the
    compliance footer; docs/dashboard.gif re-recorded.

Any message that looked like a bounce (a mailer-daemon sender, an
"Undeliverable" subject) counted toward the bounce rate even when it
matched nothing Franco sent, so a few spoofed messages could trip the kill
switch, and delay notices were treated as hard failures.

- parse_bounce(): recipients from RFC 3464 Final-/Original-Recipient (or
  the addresses in the text) and permanence from Status 5.x.x vs 4.x.x or
  delay wording; referenced_ids(): In-Reply-To and References.
- Handler acts only on a report that matches a sent outbox row (by
  Message-ID, or an address emailed in the last 14 days), names that row's
  recipient, is permanent, and hasn't been counted; otherwise it logs
  bounce_ignored and changes nothing. The SMTP adapter now passes
  References/Content-Type/Auto-Submitted headers.
- tests/test_bounces.py: real Gmail and RFC 3464 reports, References and
  recent-send matching, spoofed reports, wrong recipient, old sends,
  delays, double counting.
- scripts/record_demo.py seeds researched accounts (campaign, owner,
  score, sourced observation), M1/F1 campaigns in preview and the
  compliance footer; docs/dashboard.gif re-recorded.
Comment thread tests/test_bounces.py
Comment on lines +13 to +15
from tests.test_outbox_native import ( # noqa: F401 (state is a fixture)
FakeProvider, make_handler, seed_prospect, state,
)
Security review follow-up: anyone who knows whom Franco emails could forge
a report naming that address. Only a Message-ID match (In-Reply-To or
References pointing at an email Franco sent, which only its recipient has)
is acted on automatically; an address-only match is logged as
bounce_needs_review and changes nothing (no invalid mark, no bounce count,
no kill switch).
@heminjoshi
heminjoshi merged commit db25b1d into main Oct 17, 2026
19 checks passed
@heminjoshi
heminjoshi deleted the bounce-verification branch October 17, 2026 06:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant