On Thursday January 14 2010 20:14:48 Victor Duchovni wrote: > It may be prudent to also treat: > From: <authorA> > From: <authorB> > as synonymous with: > From: <authorA>, <authorB> > the implied meaning is that the people with those email addresses, > co-authored the email.
...or treated with utmost suspicion, as that could be an attempt to fool a MUA + a content filter combination to let mail through but still show to a reader what was desired by malware. Note that a message with a DKIM signature with only one occurrence of a 'from' in its 'h' tag is covering the bottommost instance of a 'From' header field, yet a MUA might show the topmost. When amavisd-new (since version 2.6.4) is DKIM-signing a message, it inserts a ":from:from:" into the 'h' tag, which makes a later appending of another From header field invalidate a signature. Mark
