How to stop Gmail displaying primary address when sending from other account?

My business was ruined because of this.

Why can't the Sender field be the custom address, isnt the
mailbox
shared between many email addresses? hence gmail is able to
put any of
the mailboxes aliases in the Sender field. gmail should have
told us
that our main address isnt private because even if microsoft
didn't do
the "on behalf thing", gmail is sending private
information in the
headers that we didn't know was going.

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Gmail-Users" group.
To post to this group, send email to Gmail-Usersgooglegroups.com
To unsubscribe from this group, send email to
Gmail-Users-unsubscribegooglegroups.com
For more options, visit this group at http
://groups.google.com/group/Gmail-Users?hl=en
-~----------~----~----~----~------~----~------~--~---

Excerpts from RFC822:
Section 4.4.2.  SENDER / RESENT-SENDER

        This field contains the authenticated identity  of 
the  AGENT
        (person,  system  or  process)  that sends the
message.  It is
        intended for use when the sender is not the author
of the mes-
        sage,  or  to  indicate  who among a group of
authors actually
        sent the message.  If the contents of the
"Sender" field would
        be  completely  redundant  with  the 
"From"  field,  then the
        "Sender" field need not be present and its
use is  discouraged
        (though  still legal).  In particular, the
"Sender" field MUST
        be present if it is NOT the same as the
"From" Field.

The two key points here are that the Sender *MUST* be
present if it's
not the same as From, and it must contain the *AUTHENTICATED
IDENTITY*
of the "AGENT that sends the message".

The Sender field cannot be the custom address, because you
did not
authenticate your identity at that address.  When you
performed the
initial add, you authenticated the AUTHORITY to use it, but
that is
not the same as authenticating identity.  When you log into
your GMail
account you're authenticating your identity.

I still don't understand how a business can be ruined
because of this.
 Embarrassed perhaps, but considering there are better ways
of doing
what people are trying to do by "hiding" their
information, this
should be minor.  And I'm sorry, but as soon as I hit Send
up above, I
can consider NOTHING associated with this message as private
anymore;
from my real name, or custom address, to the IP of the
machine that's
sending it (being a GMail server, they don't need *MY* IP,
I'm
authenticated to the server).  The best I can hope for is to
limit
it's dissemination to only appropriate parties.

On Jan 2, 2008 3:02 PM, Kadhumia Flo <kadhumia.flogmail.com> wrote:
>
> My business was ruined because of this.
>
> Why can't the Sender field be the custom address, isnt
the mailbox
> shared between many email addresses? hence gmail is
able to put any of
> the mailboxes aliases in the Sender field. gmail should
have told us
> that our main address isnt private because even if
microsoft didn't do
> the "on behalf thing", gmail is sending
private information in the
> headers that we didn't know was going.
>
>
> >
>

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Gmail-Users" group.
To post to this group, send email to Gmail-Usersgooglegroups.com
To unsubscribe from this group, send email to
Gmail-Users-unsubscribegooglegroups.com
For more options, visit this group at http
://groups.google.com/group/Gmail-Users?hl=en
-~----------~----~----~----~------~----~------~--~---

Well that's what you get for using a free email service that
is still
in beta for your business needs. Common sense should have
told you not
to use GMail for professional uses

On 1/2/08, Kadhumia Flo <kadhumia.flogmail.com> wrote:
>
> My business was ruined because of this.
>
> Why can't the Sender field be the custom address, isnt
the mailbox
> shared between many email addresses? hence gmail is
able to put any of
> the mailboxes aliases in the Sender field. gmail should
have told us
> that our main address isnt private because even if
microsoft didn't do
> the "on behalf thing", gmail is sending
private information in the
> headers that we didn't know was going.
>
> >
>

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Gmail-Users" group.
To post to this group, send email to Gmail-Usersgooglegroups.com
To unsubscribe from this group, send email to
Gmail-Users-unsubscribegooglegroups.com
For more options, visit this group at http
://groups.google.com/group/Gmail-Users?hl=en
-~----------~----~----~----~------~----~------~--~---

Thanks Zach for your message.

Actually I should of said deeply affected until know because
I lost
one of my main customers - it complex.

You said:
The Sender field cannot be the custom address, because you
did not
authenticate your identity at that address.  When you
performed the
initial add, you authenticated the AUTHORITY to use it, but
that is
not the same as authenticating identity.  When you log into
your GMail
account you're authenticating your identity.

Before you can send mail as gee_uk2003hotmail.om, we need to
verify
that you own this email address. To perform the verification
click
"Send Verification". We will then send an email to
*** with
instructions on how to verify your address.

So the owner has been verified as ourselves.

If you still do not agree, could you please add more
security measures
like changing the SPF record or something to enable the
Sender to
change as it's a great feature that I need (I actually use
Google
Apps) - not just for me, but for my employees where my
business has
also been affected by their sent emails.

Ali

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Gmail-Users" group.
To post to this group, send email to Gmail-Usersgooglegroups.com
To unsubscribe from this group, send email to
Gmail-Users-unsubscribegooglegroups.com
For more options, visit this group at http
://groups.google.com/group/Gmail-Users?hl=en
-~----------~----~----~----~------~----~------~--~---

Actually that's an improper statement by Google there.  All
you've
really verified is that you have ACCESS to that account, and
can
read/click links to messages received there.  I can do the
same for my
wife and son's accounts but I don't "own" them...

That said... re-read what I wrote.  You've authenticated
authority to
send messages from there, but you're not authenticating
identity;
evidenced by my statement above that I can access my wife's
account,
but I don't own it, and aren't proving it EACH TIME I log
into GMail.
The only thing I'm proving each time I log into GMail is
that I have
access to the GMail account, and that I am probably the
person who
owns it.

Further to the point.  There are a couple addresses that my
wife, son,
and I share as custom from addresses.  Mail sent TO these
addresses
actually get delivered to each of us, but only one of us is
a sender
at a time.  This is essentially what the purpose of the
Sender field
is.

GMail can't change the SPF record of any domain not under
their
control, so no they couldn't change the SPF record of
hotmail.com to
allow them to send with that custom from address without
adding
sender.  In fact, because of SPF records, many mail services
would
reject mail that originated from GMail servers with a from
of hotmail,
WITHOUT the sender header.  So your comment about SPF
records just
goes to show WHY they MUST include a Sender field, and what
it must
read.

Additionally... you mention Google Apps.  Google Apps does
have you
set an SPF record, and does NOT send a "Sender"
field when you send
from the account you're logged into.  I've done this myself.
 I don't
understand how this is affecting you.

I also still don't understand the customer who stops giving
you
business because they receive an e-mail from:
"trustedpartnerbusiness.com On Behalf Of usernamegmail.com".  If
they're freaked out by the gmail.com part, their a) naive,
and b) need
to do business in person instead of e-mail because their
concerns
SHOULD be bigger than the domain in use.

On Jan 2, 2008 3:47 PM, Kadhumia Flo <kadhumia.flogmail.com> wrote:
>
> Thanks Zach for your message.
>
> Actually I should of said deeply affected until know
because I lost
> one of my main customers - it complex.
>
> You said:
> The Sender field cannot be the custom address, because
you did not
> authenticate your identity at that address.  When you
performed the
> initial add, you authenticated the AUTHORITY to use it,
but that is
> not the same as authenticating identity.  When you log
into your GMail
> account you're authenticating your identity.
>
> Before you can send mail as gee_uk2003hotmail.om, we need to verify
> that you own this email address. To perform the
verification click
> "Send Verification". We will then send an
email to *** with
> instructions on how to verify your address.
>
> So the owner has been verified as ourselves.
>
> If you still do not agree, could you please add more
security measures
> like changing the SPF record or something to enable the
Sender to
> change as it's a great feature that I need (I actually
use Google
> Apps) - not just for me, but for my employees where my
business has
> also been affected by their sent emails.
>
> Ali
>
>
> >
>

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Gmail-Users" group.
To post to this group, send email to Gmail-Usersgooglegroups.com
To unsubscribe from this group, send email to
Gmail-Users-unsubscribegooglegroups.com
For more options, visit this group at http
://groups.google.com/group/Gmail-Users?hl=en
-~----------~----~----~----~------~----~------~--~---

Google apps also adds the "Sender" header if you
use a "Send As"
address, but the value is the Google Apps account address,
not
a ...gmail.com address.



On Jan 2, 4:07 pm, "Zack (Doc)" <z...tnan.net> wrote:
> Actually that's an improper statement by Google there. 
All you've
> really verified is that you have ACCESS to that
account, and can
> read/click links to messages received there.  I can do
the same for my
> wife and son's accounts but I don't "own"
them...
>
> That said... re-read what I wrote.  You've
authenticated authority to
> send messages from there, but you're not authenticating
identity;
> evidenced by my statement above that I can access my
wife's account,
> but I don't own it, and aren't proving it EACH TIME I
log into GMail.
> The only thing I'm proving each time I log into GMail
is that I have
> access to the GMail account, and that I am probably the
person who
> owns it.
>
> Further to the point.  There are a couple addresses
that my wife, son,
> and I share as custom from addresses.  Mail sent TO
these addresses
> actually get delivered to each of us, but only one of
us is a sender
> at a time.  This is essentially what the purpose of the
Sender field
> is.
>
> GMail can't change the SPF record of any domain not
under their
> control, so no they couldn't change the SPF record of
hotmail.com to
> allow them to send with that custom from address
without adding
> sender.  In fact, because of SPF records, many mail
services would
> reject mail that originated from GMail servers with a
from of hotmail,
> WITHOUT the sender header.  So your comment about SPF
records just
> goes to show WHY they MUST include a Sender field, and
what it must
> read.
>
> Additionally... you mention Google Apps.  Google Apps
does have you
> set an SPF record, and does NOT send a
"Sender" field when you send
> from the account you're logged into.  I've done this
myself.  I don't
> understand how this is affecting you.
>
> I also still don't understand the customer who stops
giving you
> business because they receive an e-mail from:
> "trustedpart...business.com On Behalf Of
usern...gmail.com".  If
> they're freaked out by the gmail.com part, their a)
naive, and b) need
> to do business in person instead of e-mail because
their concerns
> SHOULD be bigger than the domain in use.
>
> On Jan 2, 2008 3:47 PM, Kadhumia Flo
<kadhumia....gmail.com> wrote:
>
>
>
> > Thanks Zach for your message.
>
> > Actually I should of said deeply affected until
know because I lost
> > one of my main customers - it complex.
>
> > You said:
> > The Sender field cannot be the custom address,
because you did not
> > authenticate your identity at that address.  When
you performed the
> > initial add, you authenticated the AUTHORITY to
use it, but that is
> > not the same as authenticating identity.  When you
log into your GMail
> > account you're authenticating your identity.
>
> > Before you can send mail as gee_uk2...hotmail.om, we need to verify
> > that you own this email address. To perform the
verification click
> > "Send Verification". We will then send
an email to *** with
> > instructions on how to verify your address.
>
> > So the owner has been verified as ourselves.
>
> > If you still do not agree, could you please add
more security measures
> > like changing the SPF record or something to
enable the Sender to
> > change as it's a great feature that I need (I
actually use Google
> > Apps) - not just for me, but for my employees
where my business has
> > also been affected by their sent emails.
>
> > Ali

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Gmail-Users" group.
To post to this group, send email to Gmail-Usersgooglegroups.com
To unsubscribe from this group, send email to
Gmail-Users-unsubscribegooglegroups.com
For more options, visit this group at http
://groups.google.com/group/Gmail-Users?hl=en
-~----------~----~----~----~------~----~------~--~---

Which is why I said...
> > Additionally... you mention Google Apps.  Google
Apps does have you
> > set an SPF record, and does NOT send a
"Sender" field when you send
> > from the account you're logged into.  I've done
this myself.  I don't


On Jan 2, 2008 6:53 PM, bkennelly <bkennellygmail.com> wrote:
>
> Google apps also adds the "Sender" header if
you use a "Send As"
> address, but the value is the Google Apps account
address, not
> a ...gmail.com address.
>
>
>
>
> On Jan 2, 4:07 pm, "Zack (Doc)" <z...tnan.net> wrote:
> > Actually that's an improper statement by Google
there.  All you've
> > really verified is that you have ACCESS to that
account, and can
> > read/click links to messages received there.  I
can do the same for my
> > wife and son's accounts but I don't
"own" them...
> >
> > That said... re-read what I wrote.  You've
authenticated authority to
> > send messages from there, but you're not
authenticating identity;
> > evidenced by my statement above that I can access
my wife's account,
> > but I don't own it, and aren't proving it EACH
TIME I log into GMail.
> > The only thing I'm proving each time I log into
GMail is that I have
> > access to the GMail account, and that I am
probably the person who
> > owns it.
> >
> > Further to the point.  There are a couple
addresses that my wife, son,
> > and I share as custom from addresses.  Mail sent
TO these addresses
> > actually get delivered to each of us, but only one
of us is a sender
> > at a time.  This is essentially what the purpose
of the Sender field
> > is.
> >
> > GMail can't change the SPF record of any domain
not under their
> > control, so no they couldn't change the SPF record
of hotmail.com to
> > allow them to send with that custom from address
without adding
> > sender.  In fact, because of SPF records, many
mail services would
> > reject mail that originated from GMail servers
with a from of hotmail,
> > WITHOUT the sender header.  So your comment about
SPF records just
> > goes to show WHY they MUST include a Sender field,
and what it must
> > read.
> >
> > Additionally... you mention Google Apps.  Google
Apps does have you
> > set an SPF record, and does NOT send a
"Sender" field when you send
> > from the account you're logged into.  I've done
this myself.  I don't
> > understand how this is affecting you.
> >
> > I also still don't understand the customer who
stops giving you
> > business because they receive an e-mail from:
> > "trustedpart...business.com On Behalf Of
usern...gmail.com".  If
> > they're freaked out by the gmail.com part, their
a) naive, and b) need
> > to do business in person instead of e-mail because
their concerns
> > SHOULD be bigger than the domain in use.
> >
> > On Jan 2, 2008 3:47 PM, Kadhumia Flo
<kadhumia....gmail.com> wrote:
> >
> >
> >
> > > Thanks Zach for your message.
> >
> > > Actually I should of said deeply affected
until know because I lost
> > > one of my main customers - it complex.
> >
> > > You said:
> > > The Sender field cannot be the custom
address, because you did not
> > > authenticate your identity at that address. 
When you performed the
> > > initial add, you authenticated the AUTHORITY
to use it, but that is
> > > not the same as authenticating identity. 
When you log into your GMail
> > > account you're authenticating your identity.
> >
> > > Before you can send mail as gee_uk2...hotmail.om, we need to verify
>
> > > that you own this email address. To perform
the verification click
> > > "Send Verification". We will then
send an email to *** with
> > > instructions on how to verify your address.
> >
> > > So the owner has been verified as ourselves.
> >
> > > If you still do not agree, could you please
add more security measures
> > > like changing the SPF record or something to
enable the Sender to
> > > change as it's a great feature that I need (I
actually use Google
> > > Apps) - not just for me, but for my employees
where my business has
> > > also been affected by their sent emails.
> >
> > > Ali
>
> >
>

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the
Google Groups "Gmail-Users" group.
To post to this group, send email to Gmail-Usersgooglegroups.com
To unsubscribe from this group, send email to
Gmail-Users-unsubscribegooglegroups.com
For more options, visit this group at http
://groups.google.com/group/Gmail-Users?hl=en
-~----------~----~----~----~------~----~------~--~---