News for hackers. Stuff that matters.
Re:Email Explained from First Principles by romanixromanix on Saturday May 08, 2021 @03:00PM (#27089809)
>> Emails with multiple "From" fields in the headers

Do you think this is still possible?

Re:Email Explained from First Principles by gumby on Saturday May 08, 2021 @04:03PM (#27090217)
Sure better be, for the sake of backwards compatibility.

This isn't a problem for mail transport as the recipient is specified in the envelope and the message itself is not examined.

What a client should do in such a case is unclear. I suspect that they all use the first one encountered and ignore the rest.

Re:Email Explained from First Principles by secabeen on Saturday May 08, 2021 @04:44PM (#27090516)
Multiple From: fields are allowed by https://tools.ietf.org/html/rfc5322#section-3.6.2 as long as a Sender: is also included.
Re:Email Explained from First Principles by KasparEtter on Sunday May 09, 2021 @03:45AM (#27094072)
Just to be precise: It's a single From field with several addresses, not multiple From fields (see https://tools.ietf.org/html/rfc5322#page-21).

RFC 6854 updated the From field to allow an empty group construct (see https://explained-from-first-principles.com/email/#no-reply) but mainly for other reasons (see https://explained-from-first-principles.com/email/#email-add...).

DMARC authentication either rejects multiple addresses in the From field or authenticates them all and applies the most strict policy (see https://explained-from-first-principles.com/email/#domain-ba...).