Matthew Kitchin via Postfix-users:
> On 5/22/2025 2:34 PM, Wietse Venema via Postfix-users wrote:
> >> <donotreply-...@carespot.com>
> > Postfix receives the message with
> >
> > From: John Doe <donotreply-...@carespot.com>
> >
> >> May 22 16:58:23 vm-prod-netbox postfix/qmgr[265519]: 6A63814A356:
> >> from=<donotre...@carespot.com>, size=597, nrcpt=1 (queue active)
> >> May 22 16:58:24 vm-prod-netbox postfix/smtp[438515]: 6A63814A356:
> >> info: header From: John Doe <donotreply-...@carespot.com>: From: John
> >> Doe <donotreply-...@carespot.com>
> > And Postfix delivers the message with
> >
> > From: John Doe <donotreply-...@carespot.com>
> >
> > This is the same as the received header. I suppose that the canonical
> > mapping did not happen, or that you made a mistake while censorong
> > the real email address.
>
> I saw that and would normally agree. The odd thing is, the rewrite for
> the SMTP From is happening. The only thing I did is remove some
> characters in the middle of my address.
To be precise, Postfix delivers the message with the 'good' display
name in the From: header. The unexpected change happens after Postfix
has delivered the message to some other system.
> Maybe Azure SMTP is doing something to the message. I am not sure.
The chain is:
Thunderbird > Postfix -> Microsoft cloud > your mail user agent
The change could happen in Microsoft cloud, or in your
mail user agent.
Maybe your mail user agent (Thunderbird?) is overriding the display
name when it does not match the email address in the address book.
That cloud be a security feature.
> >> The header in the received email looks like this:
> >> User-Agent: Mozilla Thunderbird
> >> To: m***n...@carespot.com
> >> Subject: [CAUTION SPOOFING] Test Subject
> >> From: "donotre...@carespot.com" <donotre...@carespot.com>
> >> X-TsbHttpDeliveryResponseType: Success
> >> client-request-id: 1c579855-6162-400e-825f-84b1d30fe5a8
> >> request-id: 1c579855-6162-400e-825f-84b1d30fe5a8
> > Next time, please include the MESSAGE-ID header. This should match
> > the message ID that was logged by Postfix.
> Message-ID: <afeb17d5-22dc-4a3f-816f-d90293a52...@carespot.com>
That's the same one as logged by Postfix, and confirms that
this is message matches the Postfix logging.
Wietse
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
