Protocols

Envelope and letterhead

Every email carries its addresses twice, in two entirely separate places that are never compared against each other. Without knowing about that split you can understand neither phishing nor Bcc nor bounces.

The analogy is meant literally

A letter has an envelope and a sheet of paper inside it. The postal service reads the envelope; what is written on the letterhead is none of its business. The recipient takes the sheet out, throws the envelope away and reads the letterhead.

With email it is exactly the same — except that nobody checks whether the two match.

Why the split is necessary

You might think the two should simply be merged. Three everyday functions argue against it:

• Bounces. If an address is invalid, the error report has to go somewhere. It goes to the envelope address — for a newsletter, then, to a processing mailbox, not to the editorial team named on the letterhead.
• Bcc. A blind copy works only because the envelope can name recipients who do not appear on the letterhead. The server delivers to RCPT TO; what is in To: is a matter of indifference to it.
• Forwarding and mailing lists. A list takes over the envelope sender so that bounces land with the list, but leaves the letterhead standing so that the original author stays visible.

And why it is exploited

The same freedom is what makes phishing so easy. The letterhead is plain text inside the message — you write in it whatever you want. No check in the protocol compares it against the envelope or against reality.

A mail program will as a rule show only the display name, not even the address behind it. From: Your Bank <anything@stranger.example> becomes, in the message list, simply Your Bank.

What the protective measures make of it

This split is where it is decided why three procedures are needed and not one:

• SPF checks the envelope. A message can pass SPF and still appear on the letterhead in somebody else's name.
• DKIM signs parts of the message, usually including the From: line — but says nothing about the envelope.
• DMARC requires that one of the two passes and matches the domain on the letterhead. Only that makes the displayed sender verifiable.

The detail is on the page about SPF, DKIM and DMARC. Without the distinction between envelope and letterhead, though, not a sentence of it makes sense — hence this page first.

Look for yourself

Every mail program can show the complete header section of a message, usually under "view source" or "show original". Two lines are worth a look:

• Return-Path: — here the delivering server records what stood in the envelope. It is the only place where the envelope sender survives inside the message.
• Received: — one line per stop, newest at the top. Read from the bottom upwards it gives you the actual route.

If Return-Path differs markedly from From, that in itself is no alarm signal — for any newsletter it is the normal case. It is merely evidence that two different things are recorded here, answering two different questions.