When I send emails from an alias, my actual address is still shown to the recipient in the X-AuthUser header.
Is there a way to change this behavior?
My aim is to hide my “real” address from some recipients without setting up a separate account. Maybe there’s a better way to accomplish this than using an alias?
Many thanks. I love MXRoute.
Hey Dan,
Your client is actually spoofing the from: header. We allow this because of the alias use case you described. However, it can also be used for phishing. Which is why the X-AuthUser: header is there.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
I see. So it’s happening in my client (Thunderbird)? If so, you don’t happen to know if there’s a setting somewhere to skip sending that header, do you?
I also have a Posteo account I access in the same client, and sending an email through one of its aliases doesn’t include an X-AuthUser header. Maybe Posteo handles aliases differently?
Thanks for getting back to me so quickly. 
Sorry if I wasn’t clear . You client is spoofing the from header. We are adding the X-AuthUser header because spoofing the from header can be used for phishing etc. It is not possible to remove it without removing it on the entire server. Sorry
OK, understood. Thanks for the quick answer.
To clarify, this helps us to quickly identify spammers who very frequently spoof the “From” header. The X-Auth-User is what allows us to automate some spam reports and keep our IP reputation clean by reacting quickly to issues.