Re: homework, not an experiment, draft-crocker-email-deliveredto

> On 2 Aug 2021, at 9:34 pm, John Levine <[email protected]> wrote:
> 
>> In particular, it is not unreasonable for the LDA to record an encoded
>> HMAC of the recipient address in the localpart, thereby making more
>> difficult abuse of "Delivered-To:" to elicit bounces of the message to
>> the purported envelope sender (because it is then harder for the
>> attacker to predict the magic "Delivered-To:" value).
> 
> Huh, interesting point.  Do you know of an LDAs that actually do that?  If so we should
> add it to the description of the existing practice if we do a draft.
> 
> When I look at Postfix and qmail, they both appear to use the plaintext
> locally rewritten recipient address, which may not make much sense to
> software other than the MTA.

Some abuse of Delivered-To to trigger bounces has been reported now and
then, and the idea of obfuscated Delivered-To: had been discussed, but
has not yet been implemented.  The freedom to do that some day remains.

https://mailing.postfix.users.narkive.com/RMb6WBxb/delivered-to-message-header

-- 
	Viktor.