Re: whitelist on Reply-To:

Tim Rice <[email protected]> writes:

> The test I did just after Jason's post would indicate that there is
> no difference. :-(
>
> I too use SPF but it looks like it only addresses the from address in
> the envelope not the "From:" header.
>
> So my question might be, since From: & Reply-To: are so trivialy forged
> why do we trust it?

The envelope sender address is just as easily forged as From and
Reply-To. In most cases, the envelope sender address is the same as
the one in From.