[Mailsec] Re: SMTP headers in DATA block?

[Michael De Roover <[e-mail]>]

On Sunday, June 8, 2025 12:27:23 PM CEST Michael De Roover wrote:
> For the coming couple of hours, I'll be out to make and eat some food, but 
> after that I look forward to investigating this further.

Now having cooked and eaten, I have done a cursory search on the terms akin to X-
Original-To that are currently in use. I will list those findings below, as well as how I got 
them.

Current headers (non-conclusive):
- X-Original-To
- X-Google-Original-From
- X-Gm-Original-To

Sources:
- https://serverfault.com/questions/1172657/having-x-original-to-header-in-postfix-set-to-original-envelope-to-before-ma[1]
- https://support.google.com/a/answer/2368153?hl=en[2]
- https://unix.stackexchange.com/questions/41714/postfix-configuration-keep-the-envelops[3]
- https://www.postfix.org/virtual.8.html[4]
- https://superuser.com/questions/1819597/what-is-x-google-original-from-used-for[5]
- https://github.com/gophish/gophish/issues/1311[6]

What I have also done is to create a very rudimentary I-D that reserves the following 
headers:
- X-Envelope-From
- X-Envelope-To

Whether we drop the X or keep it, change the terms to something else altogether, or not 
use headers at all (do state your reasons, since this seems to be the way various orgs 
handled it so far) -- I'm certainly open to discussion about that. These values are really just 
a scaffolding to have something written down.

The idea is that these headers may be able to harmonize what a variety of email providers 
already seem to be doing with their own headers (whose behavior could be quite 
arbitrary). Being harmonized would make it easier for MUAs to detect their presence, and 
act accordingly -- regardless of which organization we're talking about. But I think that 
something setting the value should only be the final MDA. If it's set before that (i.e. 
attempted forgery), let's have the MDA just ditch it and set its own.

As always, I look forward to hearing your thoughts about it.

-- 
Met vriendelijke groet,
Michael De Roover

Mail: [e-mail]
Web: michael.de.roover.eu.org

--------
[1] https://serverfault.com/questions/1172657/having-x-original-to-header-in-postfix-set-to-original-envelope-to-before-ma
[2] https://support.google.com/a/answer/2368153?hl=en
[3] https://unix.stackexchange.com/questions/41714/postfix-configuration-keep-the-envelops
[4] https://www.postfix.org/virtual.8.html
[5] https://superuser.com/questions/1819597/what-is-x-google-original-from-used-for
[6] https://github.com/gophish/gophish/issues/1311