The email renders badly

What the symptom looks like#

• A newsletter that arrives as a column of text with the layout gone.
• Buttons that render as ordinary links, and background colours that have vanished.
• A signature block that has lost its alignment or its logo.
• A message that reads perfectly at the provider and looks plain here.

What should never happen is missing words. Sanitising removes markup and active content, not content. If text is missing rather than unstyled, that is worth reporting, and it is a different problem from an unstyled layout.

Why the sanitiser is aggressive#

An email is markup written by a stranger and rendered inside an application that holds a business's conversations. Treated casually, that markup can run code, reach across the page into the application's own interface, or call out to a server the moment a message is opened. mail_render.py therefore takes an aggressive line: active content is removed, anything that would escape the message is removed, and remote references are rewritten to the proxy rather than fetched by your browser.

The trade is deliberate and it is not symmetrical. Losing a marketing layout costs nothing that matters. Rendering a stranger's markup faithfully inside an application holding customer conversations costs something that cannot be undone. Where a message is trying to influence Connect rather than you, prompt injection arrives as ordinary business mail covers the related problem.

The rendering path#

1. Trigger — you open a message with an HTML body.
2. External event — the markup was written by the sender's system and arrived unchanged.
3. Authentication and workspace resolution — the message is read inside the workspace that owns it.
4. Ingest — the stored body is passed to mail_render.py for rendering; the stored copy is never overwritten.
5. Canonical record — the messages row keeps the original, which is what makes the rendering a view rather than an edit.
6. Classification — active content, escaping markup and remote references are each handled differently.
7. Knowledge, memory and rules — the engine reads the message's content, and rendering decisions are about what a person sees on screen.
8. Autonomy and approval — not involved; reading is not a gated action.
9. Action — the sanitised markup is rendered, with remote references pointed at the proxy.
10. Result — a readable message, sometimes a plainer one than the sender intended.
11. Relationship, timeline and memory — unaffected by how the message looked.
12. Audit, usage and Needs You — nothing is queued; rendering is not a decision.

What Connect did complete#

• The message was fetched and bridged in full, and the original body is stored exactly as it arrived.
• Every word, link and attachment is present and reachable.
• Active and escaping markup was removed before anything reached your screen.
• The sender was told nothing about the reader by the act of opening the message.

What Connect did not complete#

• It did not reproduce the sender's layout faithfully, and it does not attempt to.
• It did not run anything the message contained, including anything a sender might have intended to run.
• It did not rewrite or repair markup that was already malformed when it arrived.
• It did not alter the stored message, so nothing here is irreversible.

Seeing the original safely, and when to escalate#

1. Read the text first and decide whether the layout matters at all.

   Result For most business mail the answer is no, and the rendered view is enough.

2. Where it does matter, open the same message in the provider's own client.

   Result You see the sender's intended rendering, having chosen the risk knowingly rather than by default.

3. For a message whose meaning depends on its structure — a table of figures, a quotation — check the numbers at the provider before acting on them.

   Result A simplified table is readable and can be harder to scan than the original.

4. Ask frequent senders for a plain-text alternative.

   Result Mail sent with a text alternative reads correctly everywhere, including here.

An administrator can compare a stored message with what is rendered to confirm nothing textual was lost, and can check whether one sender's mail is consistently affected. Escalate when text or an attachment is missing rather than merely unstyled — describe the sender and the message, and never paste raw markup containing addresses or identifiers into a report.

Questions#

Related#

• Rendering HTML email safely
• Remote images in email
• Images in an email do not load
• The reply lost its formatting
• Email attachments
• Prompt injection arrives as ordinary business mail
• Security and isolation