17

I created an online account and received the usual welcome email. In addition, however, an "Undelivered Mail Returned to Sender" email appeared in my inbox one second later. I am the supposed sender, and the website I registered on the recipient. The email which could not be delivered contains (in plain text as well as in a .csv attachment) all the information I had entered upon registration. The website itself seems trustworthy/legitimate.

Since I definitely did not send an email (and do not see an email in my outbox or sent folder), I wonder how this is possible and whether this poses a security risk.

I found a related question here on this site ( i-received-an-undelivered-mail-is-my-email-address-used-maliciously), but I can't quite connect the dots.

  • It seems unlikely to me that my email was hacked or maliciously used at exactly that point of time. The password I used on the website was randomly generated and is almost surely unique among all my passwords.
  • If the header was forged and someone was trying to deceive me that I had sent an email, I'd wonder why the email and attachments contained the information I entered upon account creation. If that was a third party, would this mean the website could be compromised? Again, the timing make me wonder if this is realistic.
  • If it was a poorly configured foreign server, why would it appear as if I had tried to send an email with that specific content. The information, as far as I understand, should have been submitted/sent through the registration form. Why send another email with the same information? Why would it appear as if the email was sent from my email address?

I would appreciate if someone could shed some more light on this. Please find part of the email header (with my and the website's info anonymized) below. Please excuse the use of an image, but otherwise this post was classified as spam.

enter image description here

I also found failed-to-send-emails-that-i-never-sent, but the context is quite different to mine. In my case, the undeliverable email seems to be specifically related the the registration on the website.

3
  • 3
    all the information I had entered upon registration: does this include your plaintext password? Commented Jan 1, 2023 at 23:59
  • 2
    The password was not included. Neither in plain text nor as a hash.
    – S. G.
    Commented Jan 2, 2023 at 6:29
  • Good question, @FedericoPoloni — eases most concerns expressed in my answer as I assumed that the password was among the data being sent.
    – AJAr
    Commented Jan 3, 2023 at 9:04

3 Answers 3

31

It looks like the web service in question has configured their system to forward the welcome emails to an internal address on their end, but misconfigured their system such that the From: line is the customer's address rather than some internal address that they control. Intentional or not, they also fail to consider DMARC, so customers wind up with sketchy-looking emails like this about the website trying to email on their behalf from an unauthorized host.

You could help the service out by letting them know about the configuration issue, but ultimately things are working as they ought to as far as your email setup is concerned, so you are safe to just brush this off without consequence too. There does not appear to be any malicious intent, but the way the emails are sent with whatever PII it had is not exactly commendable.

As for why they would do this, I'm imagining that they have a weirdly tacked-together process for taking information from their registration form and delivering it to another service via SMTP since there was a CSV attached. As long as the receiving address was controlled by them, my best guess is that they're handling registrations in a frustratingly unsafe, roundabout, and kludgy way for purposes of logging, debugging, "backups," or—shudder to think—processing.

I'm also going to speculate that their Fiverr dev(s) received little oversight when stringing this together. In reality, though, this could just be that some developer had set this up as a meantime debugging measure and failed to disable it in production before anyone noticed. I'd email them.

4
  • Thanks for your answer! One detail I still wonder about is why that email would contain the information provided at registration (e. g. name, address, newsletter subscription status). So it’s not exactly the welcome email which is being forwarded, but rather the information I had provided through the website’s form when creating the account. Could the website be sending the misconfigured email when I hit the register button? I assume the info is stored to a database, because the welcome email arrived fast. Could it be they send an internal email (for internal revision) in addition to that?
    – S. G.
    Commented Dec 30, 2022 at 22:28
  • 2
    Processing web form submissions by sending emails is not that uncommon on small sites, e.g. "contact me" forms. It's used for manual processing, including a human in the flow, not for automated processing of course.
    – Bergi
    Commented Dec 31, 2022 at 8:32
  • 4
    I plead guilty of writing such a piece of code myself (for an order confirmation, not for a user registration), albeit more than 20 years ago, when I was young and stupid. The use case was that the (internal) recipient of the mail could see the customer's name in the list of mails and just hit "reply" in Outlook if they needed to reach out to the customer. Obviously, the correct solution would have been to use the Reply-To header. If I remember correctly, the framework we used for sending mails did not support that header, and SPF/etc. wasn't a big deal back then.
    – Heinzi
    Commented Dec 31, 2022 at 10:35
  • @S.G. I am imagining that they probably are doing some type of debugging or keeping backups of the form entries, but it might be the case that they have an external system which uses the same user information and, rather than sorting the external service to connect to a DB in common with the form submission code, they are sending an email to the external server. This is still speculation, of course, but picturing a sort of non-HTTP (SMTP-based) "webhook." Seems like "necessity is the mother of invention" mixed with "the right solution is the one that works." Interesting choices in many shops.
    – AJAr
    Commented Dec 31, 2022 at 14:19
5

It used to be a fairly common practice to forge the sender on some internal emails so that the admin can easily add your address to their address book.

such practice runs foul of DKIM, VERP, and SPF protections so the recipient must whitelist the web server if they have any forgery prevention measures on their mailbox server.

In this example it gets rejected by gmail.

To fix this __WEBSITE_EMAIL__ needs to whitelist their own server in their G-suite account or shift their MX and mailbox (or signup conversion email account) to a different provider and whitelist it there.

The easiest fix is probably to stop using SMTP for this path and instead set up a POP3 or IMAP account on __DOMAIN_OF_WEBSITE__ and have their gmail account pull the emails instead of pushing them using SMTP.

2

One very specific, but possibly common reason is this: The mail is sent by some software, like the popular Wordpress Contact Form 7 plugin, which allows to configure to and from fields in a GUI, but doesn't have the same comfort for the "reply-to" field. Now someone who might not even know what the "reply-to" field is configures the mails such that hitting reply will send an e-mail to the person who filled out the form. Then if there is a problem with the "to" adress, the mails will bounce to the wrong adress.

If you do this correctly with the "reply-to" field it can be a fairly practical workflow even today: You might want to download aggregate form-data from somewhere periodically or handle the data automatically, but this still notifies you when there is new data (especially in the case of infrequently used forms) and in many cases there is a subset of form entries which you might want to answer by mail (usually because there is a free text comment field in the form) and that way you can do so very easily.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .