2
2
When reading emails in Thunderbird, the contents of the "From" column are taken from the email's "From:" header. Since anything can be put in the "From:" header, I have tried (and failed) to teach some of my less tech savvy users not to trust it. I often see emails coming from random freemail addresses that are "From: The CEO". Therefore, I would like Thunderbird to completely ignore the "From:" header and use something else instead.
What I would like to do is to show the contents of the "Return-Path:", "X-Sender" or "X-Envelope-From" header. I don't mean that the name of the column has to be "From", it could be an add-on that adds a new column.
Basically, my situation is the following:
I am using Thunderbird 38.5.1 and always update to the latest version on release
I am using Getmail 4.46.0 to fetch mail from Bell Canada via megamailservers.com
A user recently received a phishing email that had the following headers:
Return-Path: <care@random-domain.org> <---- this is what I want to see
X-Envelope-From: care@random-domain.org <---- this is what I want to see
From: "CEO's name" <CEO's-email-address@ourdomain.com> X---- I want to ignore this
X-Sender: care@random-domain.org <---- this is what I want to see
Reply-To: "CEO's name" <random-address@aol.com>
To: another-C-level-person@ourdomain.com
"Return-path" is added by the sender's MTA and seems like a good candidate since most phishers are using either freemail or compromised email accounts and have no control over the setting of this header.
"X-Sender" and "X-Envelope-From" I think are added by my MTA and are probably just copied form the "Return-Path".
Unfortunately, despite the incorrect reply-to, the spam warning from spamassassin and the general wrong-ness of the message tone, the recipient fell for the phish with disastrous consequences.
Although no one in management is doubting that the recipient was completely at fault, I would feel better if I could take away the easy "it's from this person" "From" field. It may force enough of a pause in the recipient's thinking to realize that something is off.
Unfortunately, this is easier said than done for some reason.
I have tried several extensions, namely Mnenhy and Show Address Only both of which sounded like they did what I wanted but ended up just using the "From:" header anyways. It's possible that I did something wrong, of course, but they didn't seem to do the trick.
What I am looking for is any menu setting, config editor setting or extension that will allow me to display the contents of the "Return-Path:", "X-Sender" or "X-Envelope-From" headers in the list view (and, ideally, in the "From" field once the email is displayed).
First, you need better spam filtering. – Michael Hampton – 2016-02-08T18:25:48.443
1
Unfortunately, despite...the spam warning from spamassassin
The user just "figured" that the spam warning was a mistake and clicked through to get to the message. – succulent_headcrab – 2016-02-08T18:34:28.620
Unfortunately, you didn't put this message in Junk. Nor did you quarantine it, or simply refuse to accept it to begin with. – Michael Hampton – 2016-02-08T18:36:15.820
1Unfortunately, this is not a technical issue but a policy one. Delaying or auto-removing possible spam is strictly not allowed and this decision is out of my control. I would like to keep the focus relevant to the question asked. – succulent_headcrab – 2016-02-08T18:43:21.660
Out of your control or not, it is relevant to the question. Doing something about that policy issue should be your first priority. When a C-level executive gets phished because of a stupid policy, you can be sure that they will at least reconsider it. – Michael Hampton – 2016-02-08T18:44:53.467