Setting ENVELOPE FROM

[Adam H. Kerman]

My system administrator asked me to ask you a question of how alpine
sets ENVELOPE FROM.

I have one inbox on my local Mail server. The inbox has several aliases,
and I can use submailboxes using "+" to delimit the submailbox part.

mymailbox+...@example.com

I set up roles to allow me to send email from foreign servers. I assume
ENVELOPE FROM matches From on those messages.

On the local server, I just manually edit From to send with an alias or
with a submailbox.

Will ENVELOPE FROM match my edited From header, or does it use my
regular email address?

My interpretation of the use of Sender header is that I wouldn't use it
in such a circumstance as it's still my account.

Without use of a Sender header, does the standard require From and
ENVELOPE FROM match unless there's a good reason not to do so?

Thanks.

[Eduardo Chappa]

On Sun, 16 Aug 2020, Adam H. Kerman wrote:

> My system administrator asked me to ask you a question of how alpine
> sets ENVELOPE FROM.

That is a complicated question to answer because it depends on lots of
details, but in essence the answer is "the email address that Alpine
thinks belongs to the person using the computer used to send the email"
(there is an exception to this later).

Alpine tries to figure out your email address from your username and
domain. The username is the part on the left of the @ symbol in the email
address. In my case it is "chappa". You can set this up in PC-Alpine,
but not in Unix Alpine. The domain is what users configure in the "User
Domain" option in the configuration screen, and if this is not configured,
the name of your computer, or the network it belongs to.

That is the idea, so even though you may be sending messages in the
gmail.com network, your domain might be washington.edu.

This causes problems for roles, so when you are going to send an email
using roles, this is different. In that case, your email address is the
envelope from.

> My interpretation of the use of Sender header is that I wouldn't use it
> in such a circumstance as it's still my account.

I agree. There is no requirement to use the Sender header. It is an
optional header.

> Without use of a Sender header, does the standard require From and
> ENVELOPE FROM match unless there's a good reason not to do so?

No, there is no reason why the envelope from and the from address have to
match. The typical user case is of a secretary sending email on behalf of
the boss. In this case you want the From header to be the boss, and the
sender header to be the secretary, so this boils down to a problem of
authorization in the SMTP server, that is, can the secretary send messages
impersonating the boss. The envelope from would be the email address of
the secretary and the from address the one for the boss. The same issue
happens today with calendar events.

In other words, as long as the server allows the sender and the from
header to be different, there is nothing preventing this from happening.

--
Eduardo
https://tinyurl.com/yc377wlh (web)
http://repo.or.cz/alpine.git (Git)

[Adam H. Kerman]

Eduardo Chappa <cha...@washington.edu> wrote:
>On Sun, 16 Aug 2020, Adam H. Kerman wrote:

>>My system administrator asked me to ask you a question of how alpine
>>sets ENVELOPE FROM.

>That is a complicated question to answer because it depends on lots of
>details, but in essence the answer is "the email address that Alpine
>thinks belongs to the person using the computer used to send the email"
>(there is an exception to this later).

>Alpine tries to figure out your email address from your username and
>domain. The username is the part on the left of the @ symbol in the email
>address. In my case it is "chappa". You can set this up in PC-Alpine,
>but not in Unix Alpine. The domain is what users configure in the "User
>Domain" option in the configuration screen, and if this is not configured,
>the name of your computer, or the network it belongs to.

Ok. If I edit From to use an alias or submailbox, then ENVELOPE FROM is
still user@domain. Got it. Thanks. I take it SMTP Server is ignored for
setting ENVELOPE FROM.

>That is the idea, so even though you may be sending messages in the
>gmail.com network, your domain might be washington.edu.

>This causes problems for roles, so when you are going to send an email
>using roles, this is different. In that case, your email address is the
>envelope from.

Is SMTP Server in a Role also ignored for this purpose? I use the Role
command both for the purpose of setting From: and to set the matching
SMTP server. For instance, I set SMTP Server to a gmail SMTP server in
the gmail Role.

>>My interpretation of the use of Sender header is that I wouldn't use it
>>in such a circumstance as it's still my account.

>I agree. There is no requirement to use the Sender header. It is an
>optional header.

>>Without use of a Sender header, does the standard require From and
>>ENVELOPE FROM match unless there's a good reason not to do so?

>No, there is no reason why the envelope from and the from address have to
>match. The typical user case is of a secretary sending email on behalf of
>the boss. In this case you want the From header to be the boss, and the
>sender header to be the secretary, so this boils down to a problem of
>authorization in the SMTP server, that is, can the secretary send messages
>impersonating the boss. The envelope from would be the email address of
>the secretary and the from address the one for the boss. The same issue
>happens today with calendar events.

Yes. That was always my interpretation of the purpose of the Sender header,
to indicate the person who literally authenticated to the server despite
the mailbox shown on From. I realize a lot of people set the Sender header
who interpret its use differently.

>In other words, as long as the server allows the sender and the from
>header to be different, there is nothing preventing this from happening.

Thank you.

[Eduardo Chappa]

On Mon, 17 Aug 2020, Adam H. Kerman wrote:

> Ok. If I edit From to use an alias or submailbox, then ENVELOPE FROM is
> still user@domain. Got it. Thanks. I take it SMTP Server is ignored for
> setting ENVELOPE FROM.

That's correct. The smtp-server setting is completely ignored for purposes
of setting up the envelope from.

> Is SMTP Server in a Role also ignored for this purpose? I use the Role
> command both for the purpose of setting From: and to set the matching
> SMTP server. For instance, I set SMTP Server to a gmail SMTP server in
> the gmail Role.

Yes, no smtp-server setting is ever used to set the envelope from. What
counts is your email address at gmail. So, using a gmail address in a
gmail smtp-server is good, but using a gmail address in an outlook server,
or an outlook address in a gmail server is not good. You have to use an
address that the server allows as a sender.

[Lucas Levrel]

Le 17 août 2020, à 18:49, Eduardo Chappa a écrit :

> On Mon, 17 Aug 2020, Adam H. Kerman wrote:
>
>> Ok. If I edit From to use an alias or submailbox, then ENVELOPE FROM is
>> still user@domain. Got it. Thanks. I take it SMTP Server is ignored for
>> setting ENVELOPE FROM.
>
> That's correct. The smtp-server setting is completely ignored for purposes of
> setting up the envelope from.

So, if I understood you two correctly, the only way in Alpine to override
the envelope from is to use a role that sets From: ?

I'm sometimes the "secretary" of a mailing list but don't want my username
and domain to be in the mail. Secondary question: how does Alpine find my
username? I think I tried to override various env variables to no avail.

--
LL

[Eduardo Chappa]

On Wed, 26 Aug 2020, Lucas Levrel wrote:

>>> Ok. If I edit From to use an alias or submailbox, then ENVELOPE FROM
>>> is still user@domain. Got it. Thanks. I take it SMTP Server is
>>> ignored for setting ENVELOPE FROM.
>>
>> That's correct. The smtp-server setting is completely ignored for
>> purposes of setting up the envelope from.
>
>
> So, if I understood you two correctly, the only way in Alpine to
> override the envelope from is to use a role that sets From: ?

That is one way.

> I'm sometimes the "secretary" of a mailing list but don't want my
> username and domain to be in the mail. Secondary question: how does
> Alpine find my username? I think I tried to override various env
> variables to no avail.

The "MAIL FROM" command sets the "return-path" header. SMTP servers use
the value here to figure out if you are allowed the send the email you are
posting to the server. The default value is taken from the login to your
computer and the domain for your computer, except in PC-Alpine, where you
can configure both of these values.

[Lucas Levrel]

Le 26 août 2020, à 16:22, Eduardo Chappa a écrit :

> On Wed, 26 Aug 2020, Lucas Levrel wrote:
>
>>>> Ok. If I edit From to use an alias or submailbox, then ENVELOPE FROM
>>>> is still user@domain. Got it. Thanks. I take it SMTP Server is
>>>> ignored for setting ENVELOPE FROM.
>>>
>>> That's correct. The smtp-server setting is completely ignored for
>>> purposes of setting up the envelope from.
>>
>>
>> So, if I understood you two correctly, the only way in Alpine to override
>> the envelope from is to use a role that sets From: ?
>
> That is one way.

So, what are the other ways?

>> I'm sometimes the "secretary" of a mailing list but don't want my username
>> and domain to be in the mail. Secondary question: how does Alpine find my
>> username? I think I tried to override various env variables to no avail.
>
> The "MAIL FROM" command sets the "return-path" header. SMTP servers use the
> value here to figure out if you are allowed the send the email you are
> posting to the server. The default value is taken from the login to your
> computer and the domain for your computer, except in PC-Alpine, where you can
> configure both of these values.

To clarify, I don't expect to set an empty "MAIL FROM", but to set it to
the "secretary" address (list-...@example.com). My question remains:
_how_ does Alpine obtain my login? If it were from an environment
variable, I could adjust it to my liking...

--
LL

[Eduardo Chappa]

On Thu, 27 Aug 2020, Lucas Levrel wrote:

>>> So, if I understood you two correctly, the only way in Alpine to
>>> override the envelope from is to use a role that sets From: ?
>>
>> That is one way.
>
> So, what are the other ways?

I thought I explained it. Your login information in your computer, except
in PC-Alpine where you can specify both your user id and domain.

> To clarify, I don't expect to set an empty "MAIL FROM", but to set it to
> the "secretary" address (list-...@example.com). My question remains:
> _how_ does Alpine obtain my login? If it were from an environment
> variable, I could adjust it to my liking...

The way SMTP servers work today is by using the MAIL FROM command to
determine if you are allowed to send an email message from that account in
that server (and typically only setting the From header accordingly.) If
you are allowed to use the account list-...@example.com, then use a role
to send such message in the SMTP server that allows messages from that
address.

[William Unruh]

On 2020-08-28, Eduardo Chappa <cha...@washington.edu> wrote:
> On Thu, 27 Aug 2020, Lucas Levrel wrote:
>
>>>> So, if I understood you two correctly, the only way in Alpine to
>>>> override the envelope from is to use a role that sets From: ?
>>>
>>> That is one way.
>>
>> So, what are the other ways?
>
> I thought I explained it. Your login information in your computer, except
> in PC-Alpine where you can specify both your user id and domain.

I think he wants to know more specifically what alpine looks at to
determine your username and hostname. It was not running when you logged
in, so it cannot have looked at your "login information" as you logged
in . Does it look at
some environment variable ($USER)? Does it look at the uid of the
running alpine? Or does it get this information from somewhere else?

[Eduardo Chappa]

On Fri, 28 Aug 2020, William Unruh wrote:

> I think he wants to know more specifically what alpine looks at to
> determine your username and hostname. It was not running when you logged
> in, so it cannot have looked at your "login information" as you logged
> in . Does it look at some environment variable ($USER)? Does it look at
> the uid of the running alpine? Or does it get this information from
> somewhere else?

Imagine you run a linux machine. And you login to it. Your system must get
you login information from somewhere (including your home, username, etc.)
That is what Alpine does.

I have no idea why anyone would think that Alpine uses environment
variables for this purpose. The answer is Alpine does not use environement
variables for this purpose.

As I said before, it uses your login information.

But again, you are missing the point in terms of the answer: Use a role to
send email and make sure that the From: address is allowed to send email
in that SMTP server. That is all that is needed.

Most personal computers are not configured to have the exact username and
domain than the one in the SMTP server, and in particular this would be
useless as soon as you configure two accounts, but even if you could
configure one computer with this data, it would have to be part of the
network in which the SMTP server resides, and so again, it would be not
useful for most people. In other words, the infomation about login/domain
is mostly irrelevant as obtained by default by Alpine, because it hardly
ever matches the information that is needed to send the email, so
configure a role, and use the correct address in it, so that your email
can go to its destination when sent through the chosen SMTP server
attached to that email address.

Having said all of that, some ISPs set their SMTP servers open for their
subscribers, and these rules do not apply at all. The situations I am
describing have to do more with commercial services such as Gmail,
Outlook, etc.

Bottom line: do not worry about this as much, worry more about setting
your from header correctly so that it will be accepted in the SMTP server
when sending, and then everything will be work correctly.

[William Unruh]

On 2020-08-28, Eduardo Chappa <cha...@washington.edu> wrote:

>> I think he wants to know more specifically what alpine looks at to
>> determine your username and hostname. It was not running when you logged
>> in, so it cannot have looked at your "login information" as you logged
>> in . Does it look at some environment variable ($USER)? Does it look at
>> the uid of the running alpine? Or does it get this information from
>> somewhere else?
>
> Imagine you run a linux machine. And you login to it. Your system must get
> you login information from somewhere (including your home, username, etc.)
> That is what Alpine does.

It gets your machine name from the fact that you log on on that machine
or using the hostname command I assume.
login gets your username because you type it in. It then remembers your
user name because it stores it in $USER environment variable and because
it starts up programs under your uid, and remembers it because childred
of a program get the same uid as the parent.

Alpine does not user the environment variable USER (I just tried it-- I
changed USER and opened alpine, and it did not use the new USER), so it
probably gets it from the uid of running alpine program.

>
> I have no idea why anyone would think that Alpine uses environment
> variables for this purpose. The answer is Alpine does not use environement
> variables for this purpose.

Experimentally I agree.

>
> As I said before, it uses your login information.

It has to get your "login information" from somewhere. You say, and my
experiment agrees, that it does not use the environment variable to get
that information. The only other place I can imagine it getting that
information is from the uid of the alpine process.

>
> But again, you are missing the point in terms of the answer: Use a role to
> send email and make sure that the From: address is allowed to send email
> in that SMTP server. That is all that is needed.

I do not understand what you mean by a "role". I presume it is as
explained in
http://alpine.x10host.com/alpine/alpine-info/roles/

>
> Most personal computers are not configured to have the exact username and
> domain than the one in the SMTP server, and in particular this would be
> useless as soon as you configure two accounts, but even if you could
> configure one computer with this data, it would have to be part of the
> network in which the SMTP server resides, and so again, it would be not
> useful for most people. In other words, the infomation about login/domain
> is mostly irrelevant as obtained by default by Alpine, because it hardly
> ever matches the information that is needed to send the email, so
> configure a role, and use the correct address in it, so that your email
> can go to its destination when sent through the chosen SMTP server
> attached to that email address.
>
> Having said all of that, some ISPs set their SMTP servers open for their
> subscribers, and these rules do not apply at all. The situations I am
> describing have to do more with commercial services such as Gmail,
> Outlook, etc.
>
> Bottom line: do not worry about this as much, worry more about setting
> your from header correctly so that it will be accepted in the SMTP server
> when sending, and then everything will be work correctly.

I think his question is precisely how to set up the header so that it
uses his alternative From: line. I will assume that the header he wants is suitable for
his SMTP server. Alpine seems to set the From: line on its own without any way of
configuring it except by using a "role", is that correct?
>

[Carlos E.R.]

On 28/08/2020 17.26, William Unruh wrote:
> On 2020-08-28, Eduardo Chappa <cha...@washington.edu> wrote:
>
>>> I think he wants to know more specifically what alpine looks at to
>>> determine your username and hostname. It was not running when you logged
>>> in, so it cannot have looked at your "login information" as you logged
>>> in . Does it look at some environment variable ($USER)? Does it look at
>>> the uid of the running alpine? Or does it get this information from
>>> somewhere else?
>>
>> Imagine you run a linux machine. And you login to it. Your system must get
>> you login information from somewhere (including your home, username, etc.)
>> That is what Alpine does.
>
> It gets your machine name from the fact that you log on on that machine
> or using the hostname command I assume.
> login gets your username because you type it in. It then remembers your
> user name because it stores it in $USER environment variable and because
> it starts up programs under your uid, and remembers it because childred
> of a program get the same uid as the parent.
>
> Alpine does not user the environment variable USER (I just tried it-- I
> changed USER and opened alpine, and it did not use the new USER), so it
> probably gets it from the uid of running alpine program.

The command "whoami" gives the name. Probably a library call does the same.


...

>> Bottom line: do not worry about this as much, worry more about setting
>> your from header correctly so that it will be accepted in the SMTP server
>> when sending, and then everything will be work correctly.
>
> I think his question is precisely how to set up the header so that it
> uses his alternative From: line. I will assume that the header he wants is suitable for
> his SMTP server. Alpine seems to set the From: line on its own without any way of
> configuring it except by using a "role", is that correct?

I don't see in the role setup how to set the "envelope from" differently
of the "from" header. I see these:

Initialize settings using role : <No Value Set>

Set From = "..." <...>

Set Reply-To = <No Value Set>

Set Fcc = <No Value Set: using "value from fcc-name-rule">

Set LiteralSig = <No Value Set>

Set Signature = <No Value Set: using "default (.signature)">

Set Template = <No Value Set>

Set Other Hdrs = <No Value Set>

Use SMTP Server = <No Value Set>

Use NNTP Server = <No Value Set>


Maybe using "Set Other Hdrs", but how exactly? Perhaps 'Envelope-To:
<something>'?


Mutt can set the envelope from separately, they told me long ago, but
not Pine.


--
Cheers, Carlos.

[William Unruh]

On 2020-08-28, Carlos E.R. <robin_...@es.invalid> wrote:
> On 28/08/2020 17.26, William Unruh wrote:
>> On 2020-08-28, Eduardo Chappa <cha...@washington.edu> wrote:
>>
>>>> I think he wants to know more specifically what alpine looks at to
>>>> determine your username and hostname. It was not running when you logged
>>>> in, so it cannot have looked at your "login information" as you logged
>>>> in . Does it look at some environment variable ($USER)? Does it look at
>>>> the uid of the running alpine? Or does it get this information from
>>>> somewhere else?
>>>
>>> Imagine you run a linux machine. And you login to it. Your system must get
>>> you login information from somewhere (including your home, username, etc.)
>>> That is what Alpine does.
>>
>> It gets your machine name from the fact that you log on on that machine
>> or using the hostname command I assume.
>> login gets your username because you type it in. It then remembers your
>> user name because it stores it in $USER environment variable and because
>> it starts up programs under your uid, and remembers it because childred
>> of a program get the same uid as the parent.
>>
>> Alpine does not user the environment variable USER (I just tried it-- I
>> changed USER and opened alpine, and it did not use the new USER), so it
>> probably gets it from the uid of running alpine program.
>
> The command "whoami" gives the name. Probably a library call does the same.

whoami.c
/* whoami -- print effective userid
....
uid = geteuid ();
pw = (uid == NO_UID && errno ? NULL : getpwuid (uid));
....

Ie, it gets the name from the uid (well, yes, actually the euid)

[Adam H. Kerman]

Dear Eduardo,

We had this discussion a few months back. I see from the alpine 2.24
Release Notes that you subsequently changed the default on FEATURE: Do
Not Generate Sender Header to YES. Now, this is something I'd set to YES
years ago because I didn't want X-X-Sender added ('cuz it looked weird)
and I didn't agree that a Sender header was desireable. It wasn't needed
locally as I had already authenticated into my account and had
privileges to send Mail.

Could I just point out that the Help text associated with this feature
wasn't updated to reflect the new default setting.

In the second sentence, perhaps change "By default" to "Prior to version
2.24"

This is an old issue that went back to the original pine, maybe in major
version 2. I recall reading Mark Cuccia's explanation for the weirdness of
the X-X-Sender header, but I don't seem to have saved his followup article.

I also note that you might update the Help text associated with FEATURE:
Scramble the Message-ID When Sending as it continues to refer to
encoding the operating system and program version in the generated
Message-ID, which you are no longer doing as of 2.24.

[Eduardo Chappa]

On Wed, 18 Nov 2020, Adam H. Kerman wrote:

> We had this discussion a few months back. I see from the alpine 2.24
> Release Notes that you subsequently changed the default on FEATURE: Do
> Not Generate Sender Header to YES. Now, this is something I'd set to YES
> years ago because I didn't want X-X-Sender added ('cuz it looked weird)
> and I didn't agree that a Sender header was desireable. It wasn't needed
> locally as I had already authenticated into my account and had
> privileges to send Mail.
>
> Could I just point out that the Help text associated with this feature
> wasn't updated to reflect the new default setting.

Thank you. I appreciate the feedback!

> In the second sentence, perhaps change "By default" to "Prior to version
> 2.24"
>
> This is an old issue that went back to the original pine, maybe in major
> version 2. I recall reading Mark Cuccia's explanation for the weirdness
> of the X-X-Sender header, but I don't seem to have saved his followup
> article.
>
> I also note that you might update the Help text associated with FEATURE:
> Scramble the Message-ID When Sending as it continues to refer to
> encoding the operating system and program version in the generated
> Message-ID, which you are no longer doing as of 2.24.

Good catch! Thank you for pointing this out. I will make these changes!
I appreciate your help!

[Adam H. Kerman]

Adam H. Kerman <a...@chinet.com> wrote:

>This is an old issue that went back to the original pine, maybe in major
>version 2. I recall reading Mark Cuccia's explanation for the weirdness of
>the X-X-Sender header, but I don't seem to have saved his followup article.

Mark Crispin, not Mark Cuccia. The latter was a major contributor to
telecom-digest.