[Mailsec] Re: SMTP headers in DATA block?

[John Levine <[e-mail]>]

It appears that Michael De Roover  <[e-mail]> said:
>I would like to address this issue in an IETF standards document, that 
>streamlines MAIL FROM and RCPT TO from the SMTP level, with the From and To 
>from the DATA field. 

Sorry, but no.  There are good reasons that SMTP separated the envelope from
the header 45 years ago and those reasons are as valid now as they ever were.
Mailing lists like this one put an envelope address that points back to the
list manager so they can handle bounces.  If an MUA showed that rather than
the author's address in the From: header, that would just be confusing and
annoying.

As someone else noted, DMARC provides a way to say you want the envelope
and header addresses to match, and our experience with has been decidedly
mixed.

MDAs often add Return-Path: and Delivered-To: headers to log what the envelope
addresses were, but I have never seen an MUA that shows them other than for
debugging "show all headers".

R's,
John

PS:

Some MUAs apparently already show messages such as the one below.
>
>Caution: This email originated from outside the organization. Do not click 
>links or open attachments unless you recognize the sender and know the content 
>is safe.
>
>This is promising, because it means that there's already existing code that 
>modifies the DATA field on transmission from MTA/MDA to the MUA. 

I am reasonably sure text like that is inserted by the MDA or a filtering proxy
and the MUA just shows what's in the message.