An auto-reply that never loops: Auto-Submitted and who not to answer
A safe auto-reply sets Auto-Submitted: auto-replied, uses a null return path, skips automated senders and answers each sender once a week. Full checklist.
On this page(9 sections)
- What is an email loop and why does an auto-reply cause one?
- Which header marks a message as automatic?
- Who should your responder never answer?
- How do I send the reply without creating a bounce loop?
- How often should one sender get a reply?
- A checklist before you turn it on
- How do I test an auto-reply before customers see it?
- Why a global cap matters
- Bottom line
A safe auto-reply marks itself with Auto-Submitted: auto-replied, goes out with an empty return path, never answers another automated message, and answers each sender at most once per period. Skip any one of those four and two auto-responders can email each other until a mailbox fills or a provider blocks you.
This post is about sending an auto-reply from your own app or support setup. For the receiving side, see handling out-of-office replies in your sending system. For what the reply should say, see writing auto-acknowledgment emails.
What is an email loop and why does an auto-reply cause one?
A mail loop is a chain of automatic messages where each one triggers the next. Your responder answers a message, the other side's responder answers your answer, and so on. RFC 3834, the IETF recommendation for automatic responses, says an automatic responder "MUST NOT blindly send a response for every message received." Loop prevention is one of its stated reasons, alongside avoiding replies to spam and not being used to amplify abuse.
The usual culprits are your own support@ auto-acknowledgment and a customer's out-of-office, a helpdesk that replies to its own notification address, and a forwarding rule that points an address back at itself.
Which header marks a message as automatic?
Auto-Submitted is the standard one. RFC 3834 section 5 defines three values you will meet:
| Value | Use it for | Do not use it for |
|---|---|---|
no |
Messages written by a person | Anything automated |
auto-generated |
Periodic or system messages that are not replies (digests, alerts) | Replies, delivery reports |
auto-replied |
An automatic reply to another message | Manual messages, periodic jobs |
A message may carry at most one Auto-Submitted field. A receiver may assume any value other than no was not typed by a human, and responders should not answer such a message (section 2).
Two older conventions still show up in real mail. Precedence: bulk or list is not part of RFC 3834, but the RFC notes responders may ignore mail with a Precedence or List-* header that suggests list traffic. Microsoft Exchange uses X-Auto-Response-Suppress, whose values include OOF and AutoReply, per Microsoft's MS-OXCMAIL documentation. Set it on auto-replies you send to Exchange users so their out-of-office does not answer yours.
Who should your responder never answer?
Never answer anything that is probably not a person. A short rule list covers nearly every loop:
- A message with an
Auto-Submittedheader whose value is notno. - A message whose return path is empty (
<>). RFC 3834 says responders MUST NOT generate a response whose destination is a null address. - Mail from
MAILER-DAEMON,postmaster,no-replyor*-requeststyle addresses. - Mail carrying
List-Id,List-UnsubscribeorPrecedence: bulkorlist. - Mail that did not name one of your addresses in To or Cc (a Bcc copy or a mailing-list copy is not a request).
- Mail from your own domain's auto-reply address.
How do I send the reply without creating a bounce loop?
Send it with an empty envelope sender, so a failure to deliver it does not come back to you and trigger anything. RFC 3834 section 3.3 allows the responder's envelope sender to be <> for exactly this reason. Address the reply to the original Return-Path, to a single recipient, and keep the original Message-ID in In-Reply-To and References so it threads.
Return-Path: <>
To: [email protected]
Subject: Re: Invoice question
Auto-Submitted: auto-replied
X-Auto-Response-Suppress: All
In-Reply-To: <[email protected]>
References: <[email protected]>Whatever sends the reply, check that it lets you set the envelope sender and custom headers before you rely on either.
How often should one sender get a reply?
Once per period, and the RFC suggests seven days. It says personal and group responders should not issue the same response to the same sender more than once within a period of several days, and "a 7-day period is RECOMMENDED as a default." Store a record of the last reply per sender address and skip until the period ends.
For a support acknowledgment, a ticket-based rule is better than a time rule: answer once per new conversation, not once per message. A customer who sends three follow-ups should get one acknowledgment, not four.
A checklist before you turn it on
- Does the reply carry
Auto-Submitted: auto-replied? - Is the envelope sender empty?
- Does the responder skip mail that has any
Auto-Submittedvalue other thanno? - Does it skip empty return paths, list mail and
no-replysenders? - Is there a per-sender limit, and is it stored somewhere that survives a restart?
- Is there a global cap, for example a maximum number of auto-replies per hour, that stops sending and alerts you if it is hit?
- Did you test with a second mailbox that has its own auto-reply enabled?
How do I test an auto-reply before customers see it?
Use two mailboxes you control. Turn on an auto-reply on the second one, then email your support address from it. You should see exactly one acknowledgment from your side and nothing back. Repeat from a mailbox with an out-of-office enabled, then once more from a throwaway address on a mail-forwarding rule, since forwarders are a common way headers get stripped. Check the raw headers of each reply to confirm Auto-Submitted survived delivery, and watch your outbound log for a minute to make sure the count stops at one.
Why a global cap matters
Every rule above can fail in a way you did not predict, such as a customer's gateway that strips headers. A global cap turns an endless loop into a few dozen messages and a page to you. Pair it with bounce and complaint handling so that addresses that bounce your auto-reply are suppressed rather than retried.
Bottom line
An auto-reply is safe when it is marked automatic, sent with a null sender, never aimed at another machine, and rate limited per sender and overall. The marker is Auto-Submitted: auto-replied; the limits are what actually stop a loop. In Koltrix, AI-suggested drafts are never sent without a human click, so the only auto-replies you need to guard are the ones you configure yourself.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
