1 of 12

Message not delivered

About email

2 of 12

Sending a message

3 of 12

Sending a message

From: Arild Matsson <arild.matsson@gu.se>

Content-Type: text/plain; charset=us-ascii

Content-Transfer-Encoding: 7bit

Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.60.0.2.21\))

Subject: Some stuff

X-Universally-Unique-Identifier: E67767B8-0595-463F-94BC-72682DF9EF35

Message-Id: <6A5468C3-F370-4B71-9421-F97A17987375@gu.se>

Date: Mon, 31 May 2021 18:17:54 +0200

To: someone.who.does.not.exist@gu.se

Foo bar!

4 of 12

Transmission

me.net

you.net

My email client

My email client

• • •

5 of 12

Authentication-Results: gu.se; dkim=none (message not signed)

header.d=none;gu.se; dmarc=none action=none header.from=gu.se;

Received: from HE1PR0202MB2780.eurprd02.prod.outlook.com (2603:10a6:3:e9::11)

by HE1PR02MB3243.eurprd02.prod.outlook.com (2603:10a6:7:35::29) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4173.24; Mon, 31 May

2021 16:17:56 +0000

Received: from HE1PR0202MB2780.eurprd02.prod.outlook.com

([fe80::44fc:861b:a152:90e3]) by HE1PR0202MB2780.eurprd02.prod.outlook.com

([fe80::44fc:861b:a152:90e3%9]) with mapi id 15.20.4173.030; Mon, 31 May 2021

16:17:55 +0000

Content-Type: application/ms-tnef; name="winmail.dat"

Content-Transfer-Encoding: binary

From: Arild Matsson <arild.matsson@gu.se>

To: "someone.who.does.not.exist@gu.se" <someone.who.does.not.exist@gu.se>

Subject: Some stuff

Thread-Topic: Some stuff

Thread-Index: AQHXVjiDx8zb341Rc0WFraPteTwQGw==

Date: Mon, 31 May 2021 16:17:55 +0000

Message-ID: <6A5468C3-F370-4B71-9421-F97A17987375@gu.se>

Accept-Language: en-US, sv-SE

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator: <6A5468C3-F370-4B71-9421-F97A17987375@gu.se>

x-mailer: Apple Mail (2.3654.60.0.2.21)

MIME-Version: 1.0

X-Originating-IP: [78.82.38.26]

X-MS-PublicTrafficType: Email

Return-Path: arild.matsson@gu.se

X-MS-Office365-Filtering-Correlation-Id: 283a1264-b289-4f30-9b89-08d9244fa612

X-MS-TrafficTypeDiagnostic: HE1PR02MB3243:

6 of 12

Transmission

me.net

you.net

My email client

My email client

• • •

7 of 12

Bounce message

From: Microsoft Outlook

<MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@GuNet.onmicrosoft.com>

To: <arild.matsson@gu.se>

Date: Mon, 31 May 2021 16:17:56 +0000

Content-Type: multipart/report; report-type=delivery-status;

boundary="9b372635-447b-4e81-b383-d64d3af3fddb"

...

Reporting-MTA: dns;HE1PR02MB3243.eurprd02.prod.outlook.com

Received-From-MTA: dns;HE1PR0202MB2780.eurprd02.prod.outlook.com

Arrival-Date: Mon, 31 May 2021 16:17:56 +0000

Final-Recipient: rfc822;someone.who.does.not.exist@gu.se

Action: failed

Status: 5.1.10

Diagnostic-Code: smtp;550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient someone.who.does.not.exist@gu.se not found by SMTP address lookup

X-Display-Name: someone.who.does.not.exist@gu.se

8 of 12

Bounce message

9 of 12

Variable Envelope Return Path (VERP)

news.com

10 of 12

Variable Envelope Return Path (VERP)

news.com

To: arild@me.net

Return-Path: info+arild=me.net@news.com

...

To: berild@me.net

Return-Path: info+berild=me.net@news.com�...

11 of 12

Plus sign (+) in address

info+arild=me.net@news.com

= info@news.com

12 of 12

Recap

  • Every message contains Return-Path in header
  • Sending fails → server sends bounce message
  • VERP: Manipulate Return-Path to identify failing recipient