At a bank, an SMTP transcript shows one address in MAIL FROM and a different address in the message From header. Which value did the receiving server use as the envelope sender?
Select an answer to reveal the explanation.
Short Explanation
The address on the outside of the envelope is what the post office uses, even when the letterhead inside names someone else. You want MAIL FROM, the envelope sender the receiving server accepted. The trap is the header From, the Subject, or the TCP window.
Full Explanation
SMTP separates the envelope from the message headers. The receiving server takes the envelope sender from the MAIL FROM command during the transaction, so the value is The MAIL FROM value, the envelope sender the receiving mail server uses for this message. The From header inside the message, a display field the sending client is free to write itself, sits in the message data and can differ from the envelope, which is why the two addresses in this transcript do not have to match. The Subject header, a display field that names the topic and does not set the envelope, never selects the bounce address. The TCP window value, a flow-control number that has no role in naming the sender, only advertises how much data the peer can accept. Keep the envelope command and the header field in separate notes so the two addresses are not collapsed into one sender. Exam caveat: a filter may still compare the header From when it looks for display spoofing, but the envelope sender of this SMTP transaction remains MAIL FROM. Operational check: in the transcript, read the MAIL FROM command separately from the From header that appears after the DATA command.