Gmail’s “Custom From” System Messed Up By “On Behalf Of” Headers

Earlier this month, I began
using Gmail to both receive and send my email via POP. Previously, I’d just
used it to receive mail. By also sending through Gmail, I get a more complete
archive of all my mail over time. The problem is, despite setting everything to
keep my actual Gmail address hidden, it’s still getting revealed.

Here’s the situation. I want people to email me at my longstanding danny @
calafia.com email address. I don’t want them sending to my Gmail address. The
reason is simple. If I decide to leave Gmail down the line, I can’t take that
address with me. I basically want no one in the world to know it exists. If they
only know danny @ calafia.com, then my mail comes to me no matter where my mail
server is located at, since I own that domain name.

To help ensure this, I never give out my actual Gmail address. To further
ensure my Gmail address doesn’t get out, I make use of two options that should
keep it hidden. As I’ll explain, they don’t. But first the options.

In the Mail Settings area of Gmail, there’s an Accounts section. Within that
section, you can add other email addresses to use along with your Gmail account.
In my case, I added my danny @ calafia.com address. I also make this my default
setting. That means any email I send out from within Gmail should show as if it
is coming from my danny @ calafia.com account.

Indeed, here
are a variety of help pages at Gmail about the topic that give you the
impression that your Gmail address remains hidden, such as:

Keep in mind that each time someone replies to a message you send using a
custom ‘From:’ address, the reply will be delivered to the ‘From:’ address
rather than your Gmail address. If you’d like replies to be delivered to
another account, you’ll need to enter a ‘reply-to’ address. Just click
‘Specify a different reply-to address’ to enter this information. (see

here)

Once you’ve completed these steps, all messages you send will appear to be
from the email address you’ve set as your default. (see

here)

In addition to making this change at Gmail, you also have to make changes to
your mail client. Info from Google on this is covered

here. I use Outlook 2003, and specific instructions are covered
here.
However, those instructions do NOT cover the extra steps to take to disguise
your Gmail account.

After you follow the instructions, you should next got back in to edit your
email account. Choose the More Settings button, then the General tab. You’ll see
an Other User Information option. Put an organization if you want, but most
important, put the reply email address you’d like to have. This is supposed to
help ensure that no matter what POP account you send out of, only the email
address you put into that box will be shown.

In other words, even though I send out through Gmail, changing this setting
along with the other change made within Gmail is supposed to ensure that my
danny @ calafia.com address is the only thing seen by those receiving my email.

That’s not what happens, but realizing this can be hard to see. One reasons
is that I find that if you send something to yourself via Gmail from within
Outlook, then Outlook won’t download that from Gmail. I don’t know why this
happens, but it’s pretty consistent. So if you try to send and receive a mail to
check how it looks, it won’t come back into Outlook.

Now let’s say you go to Gmail itself to look at what it shows there. You’ll
just see your name shown above the email you sent. Click More Options, and
you’ll see something like this:

From: Danny Sullivan <danny @ calafia.com>
Reply-To: danny @ calafia.com
To: danny @ calafia.com
Date: Jan 31, 2006 1:18 PM

Looks good, right? Even though I sent via Gmail, my Gmail address is hidden.

Now try this. Email someone you know, then ask them to reply to your entire
email. There’s a good chance you’ll see something like this:

From: Danny Sullivan [mailto:#########@gmail.com] On Behalf Of Danny
Sullivan
Sent: Thursday, January 26, 2006 1:11 PM

OK, I’ve blanked out my Gmail address, but you can see the problem. The
person who got my email was shown my Gmail address. Despite the fact that Gmail
is supposed to keep that that hidden, the "On Behalf Of" modification still
reveals it.

Why does this happen? I’ve done a bit of poking around, and it seems mostly
related to

this:

Will messages I send using a custom ‘From:’ address be marked as spam?

Most likely, no. Even though you’re using a different email address to send
messages through your Gmail account, Gmail still ’signs,’ or validates the
messages. This way, other email services will know your message headers are
not forged.

That signing is interpreted by different mail programs in different ways.
Outlook 2003, for example, tracks that the email has been signed and does the
entire "on behalf of" thing itself. But Yahoo Mail does not. Over there, my mail
just shows as being from Danny Sullivan, danny @ calafia.com.

In Outlook, I can dig deep into the headers and see a trail like this:

Date: Tue, 31 Jan 2006 13:11:44 +0000
From: Danny Sullivan <danny @ calafia.com>
Sender: #########@gmail.com
To: danny @ calafia.com
Subject: test
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Delivered-To:  #########@gmail.com

You can see that my Gmail address is being passed along as part of this.

On the plus side, anyone replying to a message that shows your Gmail address
will still send to your other email address automatically, if you’ve set things
up as above. The downside is that some people may email to your Gmail address
manually. I’ve had a few people doing that now.

Overall, I hope they make a change so this no longer happens soon, though
it’s apparently been an issue for several months. For myself, I may have to go
back to using my own POP server to send email. That’s a bummer, because it means
I’ll have to start BCCing anything I want to be archived at Gmail.