[Mailman-Users] Wrong "From" in header, Why?

[Mark Sapiro]

On 09/20/2016 12:42 PM, Gao wrote:
>>
> What MailWatch does is just get information from maillog and save in
> mysql, then present as web page report. In this case MailWatch correctly
> shows the email is from Trent.


But if it's getting the info from maillog, it is only seeing the
envelope from, not the From: header, so this doesn't indicate that the
incoming From: is Trent.


> I also looked mailman log files:
> [root at zeta mailman]# grep "Sep 20 09:18" post
> Sep 20 09:18:12 2016 (2929) post to sjv-geosupport from
> sydv at mydomain.com, size=18655,
> message-id=<f403fa07-76de-98d9-6796-16570519b9b3 at sjgeophysics.com>, success
...
> So I see here in log file "post" it's already from Syd. If MailMan did
> not change the header, then I think the autoreponse script is highly
> suspicious.


Actually, the post log entry is written as the message is sent from
Mailman, the same time as the smtp log entry, so this really only says
MailScanner didn't do it on the way out.


> My problem now is I can't re-produce this. In fact, we have other
> people(include me) replied Syd's original email, all seems correct.
> 
> Thank you for the help.


Yes, problems that can't be reproduced are hard to diagnose, but I a as
certain as I can be that Mailman didn't do this, and I am fairly
familiar with MailScanner, and I don't think it did it either.

I still think the most likely thing is the message arrived that way at
your server, but I can't say how that happened.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan