When reading emails in Thunderbird, the contents of the "From" column are taken from the email's "From:" header. Since anything can be put in the "From:" header, I have tried (and failed) to teach some of my less tech savvy users not to trust it. I often see emails coming from random freemail addresses that are "From: The CEO". Therefore, I would like Thunderbird to completely ignore the "From:" header and use something else instead.
What I would like to do is to show the contents of the "Return-Path:", "X-Sender" or "X-Envelope-From" header. I don't mean that the name of the column has to be "From", it could be an add-on that adds a new column.
Basically, my situation is the following:
I am using Thunderbird 38.5.1 and always update to the latest version on release
I am using Getmail 4.46.0 to fetch mail from Bell Canada via megamailservers.com
A user recently received a phishing email that had the following headers:
Return-Path: <[email protected]> <---- this is what I want to see
X-Envelope-From: [email protected] <---- this is what I want to see
From: "CEO's name" <CEO'[email protected]> X---- I want to ignore this
X-Sender: [email protected] <---- this is what I want to see
Reply-To: "CEO's name" <[email protected]>
To: [email protected]
"Return-path" is added by the sender's MTA and seems like a good candidate since most phishers are using either freemail or compromised email accounts and have no control over the setting of this header.
"X-Sender" and "X-Envelope-From" I think are added by my MTA and are probably just copied form the "Return-Path".
Unfortunately, despite the incorrect reply-to, the spam warning from spamassassin and the general wrong-ness of the message tone, the recipient fell for the phish with disastrous consequences.
Although no one in management is doubting that the recipient was completely at fault, I would feel better if I could take away the easy "it's from this person" "From" field. It may force enough of a pause in the recipient's thinking to realize that something is off.
Unfortunately, this is easier said than done for some reason.
I have tried several extensions, namely Mnenhy and Show Address Only both of which sounded like they did what I wanted but ended up just using the "From:" header anyways. It's possible that I did something wrong, of course, but they didn't seem to do the trick.
What I am looking for is any menu setting, config editor setting or extension that will allow me to display the contents of the "Return-Path:", "X-Sender" or "X-Envelope-From" headers in the list view (and, ideally, in the "From" field once the email is displayed).
Unfortunately, despite...the spam warning from spamassassinThe user just "figured" that the spam warning was a mistake and clicked through to get to the message.