Skip to main content
more options

Warning Message About Sender

Have you ever seen warning like the one shown here? 

cmail-spoof

It may have made you wonder if someone was sending you forged email. You should always be on your guard, but there can also be an innocent explanation.

First, remember that every message has a complex set of headers that convey information about who the message is from, who it is to, and how it got to where it was going. Your email client typically only shows you a few of these headers, such as To, From, and Subject.  The rest are still there, under the covers.  There is also hidden information in the body of the message, dividing it into parts, for instance HTML and plain-text variations, or marking the beginnings and end of attachments.  This are called MIME parts.

Google and other providers include an anti-spam standard called DKIM on outgoing messages. DKIM provides assurance that your email came from the place that it claims, and that neither the headers nor the body of the message have been altered in transit. This is a good thing.

However, the Exchange mail system (which Cornell uses), may modify the MIME information in the message slightly, which would raise a DKIM warning. And that’s okay, so long as the message then stays within the Cornell system. because Exchange does not check DKIM headers.

But some members of the Cornell community have set up their email delivery (through WhoIAm) to forward their mail to an external email system, such as Gmail (including CMail).

So (deep breath),

  • if a message originates on a service that uses DKIM,

and

  • is sent to an Exchange mail server (which is the case for all messages sent to an @cornell.edu address,

and

  • is then forwarded to an external system that checks DKIM signatures,

a little warning flag is raised and you see the “may not have been sent by” alert.

This message by itself does not mean the message has been forged or tampered with in transit. Continue to exercise your already high level of vigilance and care in opening email from all sources.

Finally, since DKIM is not enabled for mail sent from the Cornell CMail domain, you won't see this problem on mail sent from CMail. You may see it on mail sent from a personal Gmail account to a CMail account.

You can find Google's description of this warning message at this address:

http://support.google.com/mail/bin/answer.py?hl=en&answer=185812