On Wed, 2004-11-03 at 17:06 +0000, Tony Finch wrote:
That algorithm gets the wrong "most recent sender" if you resend a message
to a mailing list. In that case the most recent sender is the mailing list
identified in the Sender: field, but the algorithm chooses your address
from the Resent-Sender: or Resent-From: field.
True. In that case we can't actually tell reliably which was most
recent, can we? Which means we'll just have to give the benefit of the
doubt -- if there's any way it could be legitimate, we mustn't reject
it. We can reject a mail with both Sender: and Resent-{From,Sender}:
headers only if _both_ parties claim that they'll always sign mail, and
a valid signature for _neither_ was found.
--
dwmw2