kgc wrote:@nliten - we've discussed this at some length and what you see is the result of those conversations.
The synthetic Received header amounts to the same thing added by our outbound SMTP servers when mail is sent through them. All major webmail providers except for gmail (as far as I'm aware) also generate this synthetic header. This has the distinct advantage that the receiving server is able to process the received headers to the original source for use in spam filtering and affords webmail users no more or no less anonymity than users that choose to use their own clients.
The plugin that you've pointed out encrypts this header but that results in a positive score in SpamAssassin due to it having an unparsable received header.
On the other hand, the data in the X-Sender could be encrypted, we'd just need to write/modify a plugin to do it.
Thanks very much for your response Kelsey.
I do see your points regarding the added "Received" header and respect your decision and reasoning to implement it, although I would personally prefer that it be dropped completely. I also had not considered that an encrypted and therefore non-parsable "Received" header would get scored and/or flagged by SPAM filtering software.
However, the "X-Sender", "X-Atmail-Account" or similar headers are of greater concern vs. the "Received" header because the data of these headers contains the immediately exploitable Sonic User Account email address. Exposing this email address undermines the benefit of using an "Alias" Sonic or other Domain based email address to keep the actual Sonic User Account email address private.
This and similar "X-" headers have clearly been harvested resulting in SPAM proliferation targeted at the respective email address. In numerous cases the email address revealed in this header was never used or provided to anyone and could not have been easily discovered from any other source or email header.
Please do consider resolving this by either encrypting the Username portion of the "X-" header data, populating it with a null data value or removing it altogether.
It should be noted that the RoundCube plug-in (with the unpacked file name: "log_sender.php") previously posted
DOESN'T encrypt the "Received" header but, encrypts the "X-Sender" header but, only IF the "Received" header was already encrypted by adding the option to encrypt it in the RoundCube Main Configuration file, "main.inc.php":
$rcmail_config['http_received_header_encrypt'] = true;
Defualt Config setting is: $rcmail_config['http_received_header_encrypt'] = false;
Alternative plug-in solution...
The following plug-in code may accomplish the goal of encrypting only the Username (Sonic User Account Email) added to the "X-Sender" header WITHOUT requiring that the "Received" header be encrypted or that any other changes be made to the RoundCube Main Configuration file, "main.inc.php". The plug-in code below was inspired by the plug-in code referenced in my previous post.
Please Note: There may already be a plug-in installed that is currently adding the un-encrypted Username to the "X-Sender" header. If so, it may need to be modified or de-activated and removed.
Code: Select all
<?php
/**
* Plugin that adds the ENCRYPTED Username to the X-Sender header.
* The Username is the actual Sonic User Account Email Address.
* Inspired by the log_sender.php plug-in v1.0 by Cor Bosman
*
* @version 1.1
* @author Sonic.net Member
*/
class log_sender extends rcube_plugin
{
function init()
{
$this->add_hook('outgoing_message_headers', array($this, 'log'));
}
function log($args)
{
$rcmail = rcmail::get_instance();
$user = $rcmail->user->data['username'];
$user = $rcmail->encrypt($user);
$args['headers']['X-Sender'] .= " ($user)";
return($args);
}
}
?>
Edits: Quote added, spelling, clarification and emphasis corrections.