smtp e-mail headers: return-path vs. sender vs. from

Question

Please help me make some order with email headers.

What does each of the following mean: return-path, sender, from.

The question is being asked in the context of an email receiving app (let's say a posterous clone).

• What can be easily faked?
• What can be verified?
• Under what circumstances can the three or two of them differ?

Answer 1

Based on my experience -

• From is the person that wrote the email. This can be set by the user's mail software.

• Return-Path is the address where bounce messages (undeliverable notifications, etc.) should be delivered. It can be set by the sending or receiving mail server, or sometimes by the user's mail software. For a normal message, it is usually the same as the From address. Some messages (often system generated messages) may use a different Return-Path, and bounce messages typically leave it blank.

• Sender is the person that sent the email, if different than the From ("Sent by X on behalf of Y"). Sometimes this is set by the user's mail software, and sometimes by their mail server. This, if present, should be different from the From address.

These headers can all be faked pretty easily, so verification is pretty much out.

However, if the sending domain has an SPF record, you can verify the Received headers against the list of approved mail servers for that domain. That will at least tell you whether or not the message really came from that domain, but that doesn't guarantee that the particular user sent it (it could be spoofed by another user on the same domain). Plus, not all domains publish SPF records, so it's not always an option.

Answer 2

I would add that in our experience, you cannot verify who is sending the message from the headers.

For this reason we implemented disposable addresses ([email protected]) at CloudMailin so that our users can give everyone a address to send to as a way to validate who is sending the message. Some other users include something in the subject line.

The Posterous FAQ's suggest that they are doing something in addition to make sure that you are who you say you are. You could for example track the IP/DNS of the server that delivers email to your email server the first time and then ask a user to confirm if you suspect there is an issue. Although its easy to spoof the headers its not to easy to receive their incoming mail.