2

When reading emails in Thunderbird, the contents of the "From" column are taken from the email's "From:" header. Since anything can be put in the "From:" header, I have tried (and failed) to teach some of my less tech savvy users not to trust it. I often see emails coming from random freemail addresses that are "From: The CEO". Therefore, I would like Thunderbird to completely ignore the "From:" header and use something else instead.

What I would like to do is to show the contents of the "Return-Path:", "X-Sender" or "X-Envelope-From" header. I don't mean that the name of the column has to be "From", it could be an add-on that adds a new column.

Basically, my situation is the following:

  • I am using Thunderbird 38.5.1 and always update to the latest version on release

  • I am using Getmail 4.46.0 to fetch mail from Bell Canada via megamailservers.com

A user recently received a phishing email that had the following headers:

Return-Path: <care@random-domain.org>    <---- this is what I want to see
X-Envelope-From: care@random-domain.org    <---- this is what I want to see
From: "CEO's name" <CEO's-email-address@ourdomain.com>    X---- I want to ignore this
X-Sender: care@random-domain.org    <---- this is what I want to see
Reply-To: "CEO's name" <random-address@aol.com>
To: another-C-level-person@ourdomain.com

"Return-path" is added by the sender's MTA and seems like a good candidate since most phishers are using either freemail or compromised email accounts and have no control over the setting of this header.

"X-Sender" and "X-Envelope-From" I think are added by my MTA and are probably just copied form the "Return-Path".

Unfortunately, despite the incorrect reply-to, the spam warning from spamassassin and the general wrong-ness of the message tone, the recipient fell for the phish with disastrous consequences.

Although no one in management is doubting that the recipient was completely at fault, I would feel better if I could take away the easy "it's from this person" "From" field. It may force enough of a pause in the recipient's thinking to realize that something is off.

Unfortunately, this is easier said than done for some reason.

I have tried several extensions, namely Mnenhy and Show Address Only both of which sounded like they did what I wanted but ended up just using the "From:" header anyways. It's possible that I did something wrong, of course, but they didn't seem to do the trick.

What I am looking for is any menu setting, config editor setting or extension that will allow me to display the contents of the "Return-Path:", "X-Sender" or "X-Envelope-From" headers in the list view (and, ideally, in the "From" field once the email is displayed).

migrated from serverfault.com Feb 8 '16 at 18:26

This question came from our site for system and network administrators.

  • First, you need better spam filtering. – Michael Hampton Feb 8 '16 at 18:25
  • 1
    Unfortunately, despite...the spam warning from spamassassin The user just "figured" that the spam warning was a mistake and clicked through to get to the message. – succulent_headcrab Feb 8 '16 at 18:34
  • Unfortunately, you didn't put this message in Junk. Nor did you quarantine it, or simply refuse to accept it to begin with. – Michael Hampton Feb 8 '16 at 18:36
  • 1
    Unfortunately, this is not a technical issue but a policy one. Delaying or auto-removing possible spam is strictly not allowed and this decision is out of my control. I would like to keep the focus relevant to the question asked. – succulent_headcrab Feb 8 '16 at 18:43
  • Out of your control or not, it is relevant to the question. Doing something about that policy issue should be your first priority. When a C-level executive gets phished because of a stupid policy, you can be sure that they will at least reconsider it. – Michael Hampton Feb 8 '16 at 18:44
2

A bugzilla lookup confirms that the Return-Path header is currently not available due to this bug - https://bugzilla.mozilla.org/show_bug.cgi?id=494100

The other headers you're looking for should be available. I am currently using the columnswizard addon for other custom columns.

  • The bug report and this addon are both good finds. Thank you. The addon you linked is exactly what I was looking for even if I can't use it for the "Return-path" header due to that bug....("trivial fix" my butt.) – succulent_headcrab Jul 12 '16 at 16:34

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.