spf-discuss
[Top] [All Lists]

Re: [spf-discuss] Trying to understand the best recommendation for my client, help appreciated.

2009-05-11 23:20:38
Under  their  current  system, which passes SPF, emails are received
from  their  system showing the from address as 
'someone(_at_)client(_dot_)com'
on behalf of 'someone(_at_)clientscustomer(_dot_)com'.

This  "showing"  is unique to certain Microsoft MUAs. I am not denying
that Outlook is in massive use, but you should be aware that this part
of your problem is not as general as you think.

Outlook  does  this  based on a mismatch between the Sender: and From:
headers. It has nothing to do -- as far as the mailreader is concerned
-- with the envelope sender.

This  is  currently  done  using  return-path  headers  in the email
generation process.

As  Alan  pointed  out,  it  is  not  the  R-P doing the work, but the
envelope  sender  (MAIL  FROM) that dictates where bounces go. The R-P
happens  to  reflect  the  envelope sender when the message is removed
from  the  SMTP  stream; any intermediate R-P is untrustworthy and not
actionable. It is very rare that any mail processing needs to be based
on  the  R-P; it would only be actionable in a specific setup where it
was  known  to  have  been applied at a trusted hop *and* the envelope
sender is not persisted in any other way.

Or, to re-simplify for your case, bounces don't go to the R-P, they go
to the MAIL FROM.

If  the  sender  is  different,  the  bounced emails go to the right
place, but the 'on behalf of' appears again.

What  you  are  confusing  is  the  Sender:  _header_ and the envelope
sender.  Outlook  wants the Sender: and the From: to match. It doesn't
care  about  the  envelope sender. So in theory, it is quite simple to
craft messages that do what you want, say using Telnet! BUT the rub is
that  many  primitive SMTP libraries -- I don't know which one you are
using,  but  you  should  divulge  it  if you want specific help -- DO
confuse header (RFC x822) and envelope (RFC x821) information. They do
this  to  make  things  "easier"  for  developers.  But  they  end  up
hard-coding relationships that have no legitimate RFC link.

For  example,  they  may  let  you supply arguments for what they call
'From',  optional  'Reply-To',  and  an optional 'Sender'. If you just
give   it   the  'From',  they  map  this  to  the  From:  header  and
(erroneously/silently/misleadingly)  to  the  envelope  sender. If you
give  it  the 'From' and the 'Sender', then the 'From' only appears in
the  header,  but  the  'Sender' goes into the Sender: header _and_ is
used  as  the  envelope sender.

Unless  they  break  out  all  the  envelope  and  header fields in an
RFC-accurate  fashion  (daring  to "confuse" the developer by actually
laying  out the way mail bodies, headers, and envelopes work!), it can
be  impossible  to  do  what  you  want  with your current SMTP client
library.  However, it is completely, and simply, possible to do with a
good SMTP library.

--Sandy



-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/735/=now
RSS Feed: https://www.listbox.com/member/archive/rss/735/
Powered by Listbox: http://www.listbox.com