Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-15831

CiviCRM defaults to sending emails with fraudulent 'from' fields

    Details

    • Type: Bug
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 4.5.5
    • Fix Version/s: Unscheduled
    • Component/s: None
    • Labels:
      None
    • Versioning Impact:
      Patch (backwards-compatible bug fixes)
    • Documentation Required?:
      User and Admin Doc

      Description

      Suppose I have a civicrm contact and I have set my primary contact email to, eg., torrance@gmail.com. Then civicrm uses this email address as my preferred 'from' address for any emails I generate, such as sending an email to a contact or when emails are automatically fired off, such as during activity creation.

      I don't think this is the correct behaviour. Big email providers know who can send email on behalf of, eg. yahoo/gmail/hotmail, and will discard any emails originating from errant servers claiming to send mail on their behalf.

      Instead, either 1) all emails from a civicrm installation need to default to a single sanctioned email address on a domain that is under the control of the provider or 2) each contact needs a unique autogenerated email address that resides on a domain that is under the control of the provider. In both cases, the provider can take steps (using SPF and DKIM) to sanction the server sending emails from their own domain.

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              torrance123 Torrance
            • Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated: