jacobwb / hashover-next

This branch will be HashOver 2.0
GNU Affero General Public License v3.0
420 stars 87 forks source link

Don’t spoof sender email addresses #316

Closed da2x closed 2 years ago

da2x commented 2 years ago

Neither sendmail nor smtp should allow sending from arbitrary email domains. Receiving servers are highly likely to reject or junk spoofed messages from senders with SPF and DKIM protection. It violates the CAN-SPAM Act too.

Use the noreply email address instead. The sending server is expected to be configured to handle email on behalf off this email address.

Include the the posting user in the reply-to header instead.

Dropped the SpamAssassin score in test mailings from +3.6 to -2.1.

jacobwb commented 2 years ago

Makes sense.