send email from the alias instead of the main account

[bdimcheff]

I noticed this when setting up an account in N1: If you send an email from an alias, it'll set the FROM header to the alias, but it'll still use the account's main email in the MAIL FROM smtp command. This causes the return path to contain the main account's email instead of the alias'. This isn't desirable in a lot of cases, since it'll leak the main account's email for any emails sent from the alias.

In my case, I have a fastmail address, plus several of my domains that fastmail handles. If I send an email from my domain, I don't want my main fastmail address to appear in the headers, and I want the DKIM/SPF checks to be against my domain and not fastmail's.

Here's an example where I changed some emails and deleted extra headers, but it's basically real. [email protected] is a (fake) fastmail address, and appears when I send email from mydomain.example.com:

Return-Path: <[email protected]>
Received-SPF: pass (google.com: domain of [email protected] designates 66.111.4.224 as permitted sender) client-ip=66.111.4.224;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 66.111.4.224 as permitted sender) [email protected];
       dkim=pass [email protected];
       dkim=pass [email protected]
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=mydomain.example.com; h=
    content-type:date:from:message-id:mime-version:subject:to
    :x-sasl-enc:x-sasl-enc; s=mesmtp; bh=38OGDUVH4qtC8WGjYv1ZawQbqLg
    =; b=RkFOq0jSmJXcag/03IMd2Zrh+72tiPZ/i4WYXGGpZutshLM+CBZ5jm1yRb4
    eq0PpHGWIOnwJMewftQgnhftTY3v6PVjl25V3mufT3m8U5jSzs5vzn3ZSXrmEPg4
    2Zn7LcO9LiqeBqKg+F65PET58GrtljGoR9k/11Ki7KRpiwnA=
To: [email protected]
From: Brandon Dimcheff <[email protected]>
Subject: test a thing

The requests from N1 appear to be correct, ie. they send the correct "from" address to the sync engine, so I did some digging in here and found the call into smtplib that is causing MAIL FROM to be the account's email.

I'm not sure that my solution is actually the right way to solve this problem, since this PR changes the call into smtplib so it uses the supplied from address instead of the email from the account itself. I tried it via curl and a local copy of the sync engine and it did indeed prevent my main account email from being exposed in the headers. If this behavior change is something you guys agree with, I'm happy to work on it more.

Since this changes the behavior of the existing API, a different backwards-compatible solution is something like: add an optional mail_from key to the send API so that defaults to "main" but you can specify "alias" if you want it to use the alias's email. That'd obviously require some changes to N1 as well, but it wouldn't change existing API behavior.

Thoughts?

Thanks!

• brandon