Hacker News new | ask | show | jobs
by eridius 4137 days ago
That would instantly get flagged as spam by virtually everybody if SPF is enabled on his domain. And yes, gmail.com seems to have SPF enabled.
3 comments

Errm no, a reply-to header is not the same as a sender envelope. Spam filters will flag emails that are faking the sender envelope. Spf is also only checking sender envelope. A reply-to can generally be what ever you want, same for from header... So linked sends email with from and reply-to headers set with your email, but sender envelop is from their server. So email appears to come from you, but was sent from linked in server, which is setup to pass spf test so does not get flagged by spam filter. Check the headers in the emails raw source, and you will see what i mean
When did I ever say anything about reply-to? Please do not put words in my mouth and then speak condescendingly to me. It's extremely irritating.
The post you were commenting on was talking about reply-to... Please practice your reading comprehension.
The post I was commenting on apparently got edited after I replied to it. And your condescension is not at all appreciated.
It appears the parent comment I was replying to got edited after I posted this. Thanks TylerJay for completely changing the meaning of your comment without any notice.

The original commented suggested that they sent the email themselves as if it had come from the user, not merely setting Reply-To.

That would only be true for only some recipients (by far not "everybody") only if Google's SPF record forbade other SMTP servers with -all. It doesn't, it uses ~all soft-fail.

Why? Precisely because of this: there are lots of perfectly legitimate situations when a third party sends email on your behalf.

Moreover, if LinkedIn signs their outgoing emails with DKIM, that would be a positive signal for a spam filter (and e.g. Gmail would show such mail as "sent via LinkedIn" or something to that effect).

Sounds like you know more about this than I do. I will defer to your greater knowledge.

Although "there are lots of perfectly legitimate situations when a third party sends email on your behalf" strikes me as being rather wrong. I cannot think of a single reason why anyone else should be sending email that claims to be coming from my email address. Sending email that lists me as a reply-to, sure. But as the sender? Not a chance.

It's common in enterprise products where the user's first action is in a non-email.

Like I've uploaded version 1 of the plans, added some notes and the system needs to send out an email to everyone, I did the action, it's coming from me, not the system.

There's a reason it's part of the spec.

You did the action, but that does not ever justify sending the email with an envelope claiming it came from you. Because you did not send the email. It could certainly put you as a Reply-To on the email, and it might possibly justify putting your name on the From line, but actually claiming to have been sent from your email address is wrong.
Says you.

However, all the clients says "why does this email come from admin@thibgy.com, I want it to come from my email address, I'm sending it".