如何在 Google App Engine 中验证传入电子邮件地址的发件人？
我正在尝试在 Google App Engine 的 Python SDK 中编写一个基于电子邮件的应用程序。我注意到 Google 允许您通过其 API 接收电子邮件，并且它可以轻松地让您访问标准字段，例如“发件人”、“收件人”、“正文”等。但是，如果我试图验证电子邮件地址是否来自它所说的发件人（有点像Posterous 为你做到了），我该怎么办？我无权访问任何电子邮件标头，因此无法检查发送服务器 IP 地址的 MX 记录或类似的内容。
有什么想法吗？
I'm trying to write a heavily email-based application in the Python SDK of Google App Engine. I've noticed that Google allows you to receive email via its API, and that it easily gives you access to the standard fields like From, To, Body, etc. However, if I'm trying to verify that an email address came from who it said it came from (kind of in the way that Posterous does it for you), how can I? I don't have access to any of the email headers, so I can't check the MX record of the sending server's IP address or anything fancy like that.
Any ideas?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
实际上，虽然没有详细记录，但来源 此处建议原始 mime 邮件您获得的方便对象的形状可以作为方便对象的
.original属性使用——这是 email.message.Message，因此您应该能够从那里获取电子邮件标头。不过，我不确定这会让您在寻求验证方面走得更远。Actually, while not well documented, the sources here suggest that the original mime message from which the handy objects you get are shaped is available as the
.originalproperty of the handy object -- that's an instance of email.message.Message, so you should be able to get email headers from there. I'm not sure that takes you much further in your quest for validation, though.电子邮件通常不是可验证的媒介，除非您使用 PGP 或 S/MIME 对其进行签名。如果您没有标头，则没有任何内容需要验证。
您唯一能做的就是通过电子邮件发送地址并要求对方确认他们确实发送了该消息。这对于欺诈性电子邮件发件人来说要伪造要困难得多（但并非不可能）。
或者您可以要求用户在每条消息中输入密码。
E-mail isn't generally a verifyable medium, unless you sign it with PGP or S/MIME. If you don't have headers, you haven't got anything to verify.
The only thing you can do is e-mail the address and ask the person to confirm that they really sent the message. That's a lot harder for the fraudulent e-mail sender to fake (but not impossible).
Or you could possibly ask the user to put a password in every message.
亚历克斯关于访问标头的说法是正确的，但这不允许您验证电子邮件的实际发件人：任何人都可以使用他们希望的任何“发件人”地址发送电子邮件，因此不要依赖发件人地址作为权威证明谁发送的。
Alex is right about accessing the headers, but this doesn't allow you to verify the actual sender of the email: anyone can send an email with any 'from' address they wish, so don't rely on the from address as authoritative proof of who sent it.
如果这是注册过程或类似过程的一部分，那么您为什么不向（据称）发起者发回“挑战”（例如用于继续注册或其他任何内容的 URL，带有唯一且有时限的密钥） ？这样您就可以验证电子邮件地址是否不是伪造的。
“大佬”（例如谷歌）经常使用这个过程，一定有一个原因。
如果这不适合您的用例，请忽略我的建议。
更新：您可以让电子邮件在到达您的 GAE 申请之前通过另一个 Web 服务（待定）传输吗？这样，您仍然可以利用 GAE，同时在其他地方完成电子邮件验证等低处理开销工作？
If this is part of a registration process or alike, then why don't you send back a "challenge" (e.g. URL to go for continuing registration or whatever, with a unique & time-bound key) to the (supposedly) originator? This way you can verify if the email address isn't forged.
The "big guys" (e.g. Google) use this process a lot, there must be a reason.
Disregard my suggestion if that doesn't fit your use-case.
Updated: you could have the emails transit through another Web Service (To be determined) before reaching your GAE application? This way, you could still leverage GAE whilst having a low processing overhead job such as email verification done someplace else?
您只能使用 DKIM 验证发件人。 GAE 自动使用 DKIM 签署 google 帐户电子邮件，但您需要外部服务（应通过 http/https 访问）来查询 DNS 并为您提供 txt DNS 字段。
You can verify the sender only using DKIM. GAE automatically signs the google accounts emails with DKIM but you need an external service(which should be accessed through http/https) to query the DNS and provide you the txt DNS fields.