Ask HN: Why are most web services "spoofing" the From email header?

#1

Post by boronine » Mon, Jan 29, 2024, 6:14 PM UTC

All examples below are "From" headers in emails sent from various web services to our corporate email. This makes it look like we are sending emails to ourselves.

Some examples:

    "'Amazon Web Services' via Redacted - Admin" 
    'Mezmo, Inc.' via Redacted Inc. - Admin 
    'service@intl.paypal.com' via Redacted - Admin 
    noreply-spamdigest via Redacted - Support 
    'Shopify Partners' via Redacted Inc. - Admin

Some notable exceptions:

    Heroku Billing Team 
    Wise

Questions:

1. What could be the justification for this practice?

2. Does this practice have a name?

3. Is this not considered spoofing?

4. Reading plainly, "X via Y" implies that Y is facilitating something on behalf of X, is this the intended reading?

Re: Ask HN: Why are most web services "spoofing" the From email header?

#2

Post by sacrosanct » Mon, Jan 29, 2024, 6:41 PM UTC

If the shop is doing DMARC[0] & DKIM[1] this is a non-issue

[0] https://en.m.wikipedia.org/wiki/DMARC

[1] https://en.m.wikipedia.org/wiki/DomainKeys_Identified_Mail

Re: Ask HN: Why are most web services "spoofing" the From email header?

#3

Post by boronine » Mon, Jan 29, 2024, 7:16 PM UTC

sacrosanct wrote: post #2

If the shop is doing DMARC[0] & DKIM[1] this is a non-issue [0] https://en.m.wikipedia.org/wiki/DMARC [1] https://en.m.wikipedia.org/wiki/DomainKeys_Identified_Mail

That DMARC link talks about "From: rewriting" with a similar example using "via". I suppose this addresses the "spoofing" part of my question, thanks! I would still like to know more about this practice in transactional emails.