Howdy.

I am flabbergasted ( <-- learned that word in 1978).

Yesterday someone responded on an email which I had posted on a distribution-list but her/his response contained all the headers which are usually generated by the mailing-list program (Sympa, in this case).

In consequence, the response looks as if it were coming from the list, while the originator addressed me directly. Even the header “Sender” is showing the mailing-list!

Her/his mail-software apparently does not remove or replace these headers, as I thought it should. I have to take this into account for my filters. Unfortunately, there is not only no hint on the mail-client used, but my own (hand-compiled) “Mutt 1.10.1+152 (78a60fc9) (2018-08-28)” is showing up!

Question: May it be that way?
I feel that rather someone has done only half the work and has devised an awfully “lazy” mail-client, to say the least.

Even if I found an RFC stating something more or less obvious.., who reads RFCs, these days... programmers?

The headers get added to when your mail RECIEVES the email. Those headers should show where it really came to you from and also show you if any checks (dkim, spf) passed or failed.

If this came to you from a mailing list then you'd need to talk to the admins of that list to report the problem.

Did I express myself that badly..?

If I tried to re-formulate the issue, it would result in the same post as above. I am doomed.

I was saying that the headers don't only include what the sender wants you to see. They get added to by the mail application that receives them to show where it came from.

You seemed to be implying the problem you were seeing was email you were getting from a mailing list. If so the headers are those put on it by the mail application the list uses to send TO you and would again have headers added by whatever mail application received it on your end.

If it is a mailing list it would not be surprising that the headers seen are always the same because you're not seeing the headers of the original sender TO the mailing list - you're seeing the headers of it being sent FROM the mailing list to you.

That was why I suggested contacting the mail list admins. They would have logs that showed who really sent it TO them even if he pretended to have sent it as you.

You might want to compare headers of a "legitimate" message from the mail list to the one you say was spoofed.

P.S. This is why troubleshooting mail issues is sometimes an issue. Users do inline forward of an email which means you only see the headers as if they had sent you an email out of the blue rather than the headers of the email as they received it. If they instead attach the problem email you can usually open the attachment and see its headers.

A comment regarding filters, which is a bit of a followup on what MensaWater is saying.

Filters should (probably) only look at the header lines added by the receiving (your) MTA. Other headers are not at all trustworthy (as you're seeing). For example, the only header line I usually concern myself with is the last (topmost) one:
my qmail is configured to always say "from unknown" -- so when scanning email, I look for that line...and I know that's the IP address of the server that connected to deliver the mail. This example is a legitimate email from Medicare.
That line in a spam message gives me the IP of the spammer, and I can then complain to their ISP and/or block the IP from delivering email to my server.

If I target SPAM, I use to analyze the Received-headers.

But if I want to filter out mail from mailing-lists for storage or whatever, I have to look somewhere else. The lists that I administer have a prefix in their subject-lines, this is simple. But this and anything else appears to be unreliable, now, as mail which is sent via “Reply-To” and not “Reply-to-all” or something similar, appears in my mailbox with the identical attributes as those messages originating from a mailing list, although they are not.

I can cope with this.

My only question is, so far: Is this behavior of a system faulty or not. As this very question is not very interesting to many people, I generalized it a little:
Convention on re-using mail-headers when replying.

In my opinion, a message that is not sent via a mailing-list should not pretend to be. But we can let that rest, here, if you prefer. Should the topic gain importance, I will look-up the RFCs and draw my own conclusions.

By "headers" I mean the full extra detail seen which usually requires expanding the default view of an email. It sounds to me as if you're just talking about the basic view of an email which is not "header" but rather just basic to/from/cc/subject info.

For example on junk email I received today it shows basic info:
However, the full headers of the email include:
Much of the foregoing is from Microsoft Office365 which we use for inbound email. Also you see Avanan which is a mail filter company and an AmazonWS IP which they use. This is what I meant when I said the system that receives it adds to the headers.

In the BOLD section you see that it claimed to have come from domain, whidbeyislandbeaches.com, but it actually came from IP 212.110.2.16. It shows that IP is not authorized to send emails for that domain.

If I check that IP it shows the PTR (reverse) is:
host 212.110.2.16
16.2.110.212.in-addr.arpa domain name pointer ip-2-16.sn-212-110.clouditalia.com.
A whois lookup of the IP confirms that it is in Roma Italy.

Since the email purports to be from a Canadian Pharmacy it seems unlikely they'd be using Italian cloud hosting services.

It is very unlikely that anyone that spoofed a list domain would send to the list in such a way that it would have the same headers as the original legitimate email.

You now seem to be saying the mail list in question is one you you administer. If so you should be able to examine the logs to see who actually sent it to the list. The only way someone could completely spoof the headers FROM the list would be if they hacked your mail server and were actually sending it from that. You would want to verify very quickly your mail server is not an "open relay" accepting emails to send as if they originated on the mail server itself. That will get you blacklisted in a hurry. So would any hack where they were directly connecting and send emails from your mail server.

I cannot explain myself in plain English.
This is the current result of this thread.

Let us, for a moment, forget mailing-lists. Do as if they do not exist.
Let us, for a moment, forget SPAM. Do as if it does not exist. My OP has nothing to do with SPAM. There is none, has been none, I am not referring to SPAM.

I receive an email from someone I know. Personally. I can go and see him, and happen to meet him in town. This is the authentic part.

This mail contains headers which declare that the sending mail-client is not his but mine and headers which declare that the mail were sent via a mailing list, which it is not. Even if you ignored the existence of mailing lists and ignored the possibility of SPAM, you can detect that something is awkward.

If I am still not able to explain the point, I want to ask you to forget it. Do as if I do not exist.