goauthentik / goauthentik/authentik
Authentik sends an email to root@example.com
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
### Describe the bug
I got a bounce notification from my SMTP provider saying my email to root@example.com could not be delivered (obviously, that's not a real email address).
Apparently, Authentik tried to send such an email. Why? According to the audit logs:
But I never configured such a user account nor set such an email address. It seems like a bug that Authentik would ever try to send an email to an address that I never configured, without asking.
I can see where Authentik hardcodes root@example.com:
https://github.com/goauthentik/authentik/blob/ec4847182d5cd2a65d7be01f4fde8b22fb90b061/blueprints/system/bootstrap.yaml#L12
But not why it's actually using the address, nor how to fix it.
### How to reproduce
This happened without my intervention, and it's an existing installation that has been upgraded from many previous versions, so I don't know how to reproduce it from scratch. I guess one just sets up Authentik with the default settings, enables the SMTP environment variables outlined in the documentation, and doesn't turn off update checking.
### Expected behavior
An email should only be sent to the email address of my actual administrator account that I set up during initial configuration.
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Docker
### Version
2026.5.2
### Relevant log output
```shell
```
Contributor guide
Research direction
Start with blueprints/system/bootstrap.yaml at line 12, then trace how that default account or address reaches the audit-log email path. Confirm why an email is sent to root@example.com and define the fix so notifications target only the administrator address configured during initial setup; add or update a regression test if the relevant test location is found.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100