Hacker News Reader

Comment by bad_user | Hacker News Reader

> “Emails that are sent from a domain that's different than the from address are legitimately suspicious”

That’s not how this works. The “from” email header has nothing to do with the actual sender due to the email standard. The actual sender is specified in the SMTP command.

This is why SPF and DKIM for example have nothing to do with “from” either. SPF refers to the sender in the SMTP command and DKIM signing can use the keys of a domain unrelated to “from” and it’s all legal.

It’s very easy actually to spoof the “From” header and Gmail won’t complain.

That “via” information you’re seeing is just another header that doesn’t have much to do with Gmail. If you’re seeing it, that’s because the sender wants you to see it.

View on HN

Nobody said it wasn't legal according to specs, but that it's suspicious. And it is. Having a "From" header in the email that doesn't match the sender used for SMTP _is_ suspicious, and certainly should be an input signal for any spam filter.

Not suspicious at all. It's how mailing lists work.

From on the envelope will be address of the mailing list, and from in the headers will be the original sender. Perfectly legitimate and extremely annoying if anythig uses this as a SPAM signal.

Not suspicious for a mailing list, sure. But definitely suspicious for a security-related email from what is essentially a bank.

Why? They simply want bounces delivered to a differnt address than the real replies from customers. Seems reasonable if it's a from address used for a mass/automated mailing. (it is)

This was solved decades ago[0] with the Reply-To header. Send emails from no-reply@paypal.com and set the Reply-To to support@paypal.com.

Emails then bounce to no-reply@ and any legitimate email client will auto-populate support@ as the To address when the user clicks reply.

[0] https://www.ietf.org/rfc/rfc2076.txt

Sure there are alternatives, but it's still not suspicious. I just went through my "shopping" folder and more than a few comapnies have different From header domain and envelope From domain, including some big american ones like Airbnb who presumably know what they're doing.

Also PayPal was a contributor to DMARC RFC, so they presumably know what they're doing too around e-mail, wouldn't you say?

I get confirmations of flight reservations where env-From is mandrill app and From is kiwi.com. DMARC passes. Some of my banks do this, too. Registrar of my domains does this. Many others too.

It's just not suspicious and these are very important senders to me (I mean I'd hate to fail to renew my domain, or miss that one-in-a-lifetime e-mail that someone is withdrawing money from my bank account other than me, because of a braindead SPAM policy) and google should not care.

Note that DMARC modifies the meaning of SPF. SPF without DMARC protects the envelope-sender and not the From header.

With DMARC SPF protects the From header as well.

SPF, DKIM, and DMARC maybe useful against fishing. In the long run it doesn't do anything against spam. So it is rather unfortunate that gmail (certainly on IPv6) is so eager to classify mail without those headers as spam.

> It’s very easy actually to spoof the “From” header and Gmail won’t complain.

Which is why Gmail will use this as a signal for spam and why Papal should have them match.

Reply on news.ycombinator.com