3 ms·

Nobody said it wasn't legal according to specs, but that it's suspicious. And it is. Having a "From" header in the email that doesn't match the sender used fo

Nobody said it wasn't legal according to specs, but that it's suspicious. And it is. Having a "From" header in the email that doesn't match the sender used for SMTP _is_ suspicious, and certainly should be an input signal for any spam filter.

megous 8y ago
Not suspicious at all. It's how mailing lists work. From on the envelope will be address of the mailing list, and from in the headers will be the original sender. Perfectly legitimate and extremely annoying if anythig uses this as a SPAM signal.
- kelnos 8y ago
  Not suspicious for a mailing list, sure. But definitely suspicious for a security-related email from what is essentially a bank.
  - megous 8y ago
    Why? They simply want bounces delivered to a differnt address than the real replies from customers. Seems reasonable if it's a from address used for a mass/automated mailing. (it is)
    - deleted 8y ago
      [deleted]
    - jakejarvis 8y ago
      This was solved decades ago[0] with the Reply-To header. Send emails from no-reply@paypal.com and set the Reply-To to support@paypal.com. Emails then bounce to no-reply@ and any legitimate email client will auto-populate support@ as the To address when the user clicks reply. [0] https://www.ietf.org/rfc/rfc2076.txt https://www.ietf.org/rfc/rfc2076.txt
      - megous 8y ago
        Sure there are alternatives, but it's still not suspicious. I just went through my "shopping" folder and more than a few comapnies have different From header domain and envelope From domain, including some big american ones like Airbnb who presumably know what they're doing. Also PayPal was a contributor to DMARC RFC, so they presumably know what they're doing too around e-mail, wouldn't you say? I get confirmations of flight reservations where env-From is mandrill app and From is kiwi.com. DMARC passes. Some of my banks do this, too. Registrar of my domains does this. Many others too. It's just not suspicious and these are very important senders to me (I mean I'd hate to fail to renew my domain, or miss that one-in-a-lifetime e-mail that someone is withdrawing money from my bank account other than me, because of a braindead SPAM policy) and google should not care.

megous 8y ago

Not suspicious at all. It's how mailing lists work. From on the envelope will be address of the mailing list, and from in the headers will be the original sender. Perfectly legitimate and extremely annoying if anythig uses this as a SPAM signal.

kelnos 8y ago
Not suspicious for a mailing list, sure. But definitely suspicious for a security-related email from what is essentially a bank.
- megous 8y ago
  Why? They simply want bounces delivered to a differnt address than the real replies from customers. Seems reasonable if it's a from address used for a mass/automated mailing. (it is)
  - deleted 8y ago
    [deleted]
  - jakejarvis 8y ago
    This was solved decades ago[0] with the Reply-To header. Send emails from no-reply@paypal.com and set the Reply-To to support@paypal.com. Emails then bounce to no-reply@ and any legitimate email client will auto-populate support@ as the To address when the user clicks reply. [0] https://www.ietf.org/rfc/rfc2076.txt https://www.ietf.org/rfc/rfc2076.txt
    - megous 8y ago
      Sure there are alternatives, but it's still not suspicious. I just went through my "shopping" folder and more than a few comapnies have different From header domain and envelope From domain, including some big american ones like Airbnb who presumably know what they're doing. Also PayPal was a contributor to DMARC RFC, so they presumably know what they're doing too around e-mail, wouldn't you say? I get confirmations of flight reservations where env-From is mandrill app and From is kiwi.com. DMARC passes. Some of my banks do this, too. Registrar of my domains does this. Many others too. It's just not suspicious and these are very important senders to me (I mean I'd hate to fail to renew my domain, or miss that one-in-a-lifetime e-mail that someone is withdrawing money from my bank account other than me, because of a braindead SPAM policy) and google should not care.