smtp e-mail headers: return-path vs. sender vs. from

Question

Please help me make some order with email headers.

What does each of the following mean: return-path, sender, from.

The question is being asked in the context of an email receiving app (let's say a posterous clone).

• What can be easily faked?
• What can be verified?
• Under what circumstances can the three or two of them differ?

Answer 1

Based on my experience -

• From is the person that wrote the email. This can be set by the user's mail software.

• Return-Path is the address where bounce messages (undeliverable notifications, etc.) should be delivered. It can be set by the sending or receiving mail server, or sometimes by the user's mail software. For a normal message, it is usually the same as the From address. Some messages (often system generated messages) may use a different Return-Path, and bounce messages typically leave it blank.

• Sender is the person that sent the email, if different than the From ("Sent by Sender on behalf of From "). Sometimes this is set by the user's mail software, and sometimes by their mail server. This, if present, should be different from the From address.

These headers can all be faked pretty easily, so verification is pretty much out.

However, if the sending domain has an SPF record, you can verify the Received headers against the list of approved mail servers for that domain. That will at least tell you whether or not the message really came from that domain, but that doesn't guarantee that the particular user sent it (it could be spoofed by another user on the same domain). Plus, not all domains publish SPF records, so it's not always an option.

Answer 2

The "From" Header it intended to be the Person that the message is from. It is who the recipient's email client should display the message is from.

The Return-Path header specifies where replies (or bounces/NDR's) should be delivered. This may be different that the "From" address in the case of mailing lists, and many automated messages where bounces are sent to a system that removes non-deliverable addresses.

The sender can be thought of as a more specific version of the From header. If the message was originated by somebody, or some other system that the actual 'From' address. Examples might be gmail when it is configured for a domain not hosted by Gmail. In this case, the From header would contain 'you@yourdomain.com', but the Sender will be 'someuser@gmail.com'. Many mail clients now render this as 'someuser@gmail.com on behalf of you@yourdomain.com'. The "Sender" header should be used for mail authentication (SPF/DKIM) purposes since that is the system that actually originated the message.

Answer 3

I would add that in our experience, you cannot verify who is sending the message from the headers.

For this reason a lot of people will implement disposable addresses (example+uniquecode@example.com) and give every outgoing message an address to send to as a way to validate who is sending the message. Some other users include something in the subject line.

The Posterous FAQ's suggest that they are doing something in addition to make sure that you are who you say you are. You could for example track the IP/DNS of the server that delivers email to your email server the first time and then ask a user to confirm if you suspect there is an issue. Although its easy to spoof the headers its not to easy to receive their incoming mail.