28

Please help me make some order with email headers.

What does each of the following mean: return-path, sender, from.

The question is being asked in the context of an email receiving app (let's say a posterous clone).

  • What can be easily faked?
  • What can be verified?
  • Under what circumstances can the three or two of them differ?
flybywire
  • 261,858
  • 191
  • 397
  • 503
  • 1
    possible duplicate of [What's the difference between Sender, From and Return-Path?](http://stackoverflow.com/questions/4367358/whats-the-difference-between-sender-from-and-return-path) – MaxiWheat May 05 '14 at 13:26

3 Answers3

34

Based on my experience -

  • From is the person that wrote the email. This can be set by the user's mail software.

  • Return-Path is the address where bounce messages (undeliverable notifications, etc.) should be delivered. It can be set by the sending or receiving mail server, or sometimes by the user's mail software. For a normal message, it is usually the same as the From address. Some messages (often system generated messages) may use a different Return-Path, and bounce messages typically leave it blank.

  • Sender is the person that sent the email, if different than the From ("Sent by Sender on behalf of From"). Sometimes this is set by the user's mail software, and sometimes by their mail server. This, if present, should be different from the From address.

These headers can all be faked pretty easily, so verification is pretty much out.

However, if the sending domain has an SPF record, you can verify the Received headers against the list of approved mail servers for that domain. That will at least tell you whether or not the message really came from that domain, but that doesn't guarantee that the particular user sent it (it could be spoofed by another user on the same domain). Plus, not all domains publish SPF records, so it's not always an option.

Jeremy Cook
  • 20,840
  • 9
  • 71
  • 77
Bill B
  • 1,280
  • 13
  • 16
  • Just a note on this, Outlook seems to like having `Sender` even if it's the same as `From`. The Preview Pane, for example, shows a blank sender if the `Sender` header is not part of the message, even if `From` is there. – Jeff Evans Dec 10 '13 at 18:54
  • So `from` and `sender` can be empty? How would you send an email with empty values for those fields? (If anyone is interested, [Mailgun also has descriptions for those fields](http://documentation.mailgun.com/user_manual.html#parsed-messages-parameters).) – Dennis Jun 05 '14 at 16:39
  • 1
    @Dennis My reading of RFC2822 leads me to believe that the From header is required, and Sender should or should not appear depending on the situation. Looking at your Mailgun reference, their "from" is populated by the "From" message header, but their "sender" is populated by the "From" in the SMTP envelope, *not* the "Sender" message header (which I assume you would need to get from their "message-headers" parameter) – Bill B Jun 08 '14 at 03:21
8

The "From" Header it intended to be the Person that the message is from. It is who the recipient's email client should display the message is from.

The Return-Path header specifies where replies (or bounces/NDR's) should be delivered. This may be different that the "From" address in the case of mailing lists, and many automated messages where bounces are sent to a system that removes non-deliverable addresses.

The sender can be thought of as a more specific version of the From header. If the message was originated by somebody, or some other system that the actual 'From' address. Examples might be gmail when it is configured for a domain not hosted by Gmail. In this case, the From header would contain 'you@yourdomain.com', but the Sender will be 'someuser@gmail.com'. Many mail clients now render this as 'someuser@gmail.com on behalf of you@yourdomain.com'. The "Sender" header should be used for mail authentication (SPF/DKIM) purposes since that is the system that actually originated the message.

Brandon
  • 465
  • 5
  • 14
0

I would add that in our experience, you cannot verify who is sending the message from the headers.

For this reason a lot of people will implement disposable addresses (example+uniquecode@example.com) and give every outgoing message an address to send to as a way to validate who is sending the message. Some other users include something in the subject line.

The Posterous FAQ's suggest that they are doing something in addition to make sure that you are who you say you are. You could for example track the IP/DNS of the server that delivers email to your email server the first time and then ask a user to confirm if you suspect there is an issue. Although its easy to spoof the headers its not to easy to receive their incoming mail.

Steve Smith
  • 5,146
  • 1
  • 30
  • 31
  • Isn't the dot and plus character only supported by Gmail? – Pacerier Feb 15 '17 at 05:26
  • The + isn't really the critical part of this response. The fact is that without having a unique identifier as the recipient of the returned message it's hard to validate the sender. Zendesk uses this format (support+xxxxxx-xxxx@dynamicedge.zendesk.com), as does intercom (notifications+admin_xxxx_xxxxxxxxxxxxx@intercom-mail.com). If you run your own mailservers or work with a third party that specialises in incoming email then they will generally support the + but they'll also accept any unique address on the domain. – Steve Smith Feb 23 '17 at 14:55