nextcloud / nextcloud/mail

Using Reply-To incorrectly triggers phishing warning

Open
#12,159 3 comments 0 reactions 1 assignee View on GitHub

@DerDreschner is already working on this.

Since Jan 9, 2026.

1. to develop bug
Dominant language
JavaScript
Stars
1k
Forks
348
Avg merge
12h 28m
Merged PRs (30d)
91

Description

Steps to reproduce

Send email with the Reply-To header set (to anything except for the sender email).

Expected behavior

No warning should occur, since the whole purpose of the Reply-To header is to inform clients that "responses should be addressed to a different mailbox"^1.

Actual behavior

The mail app claims that "This email might be a phishing attempt", stating that the "Reply-To email: [...] is different from sender email: [...]".

Mail app version

5.6.4 (current), affecting all versions after commit 9b87b23/v4.0.0-alpha1

Nextcloud version

No response

Mailserver or service

No response

Operating system

No response

PHP engine version

None

Nextcloud memory caching

No response

Web server

None

Database

None

Additional info

This issue was introduced by commit 9b87b23, which merged the corresponding PR #9610. @kesselb mentioned this in a comment which was unfortunately not further discussed.
Unfortunately, the "Reply-To" check (as currently implemented) issues spurious phishing warnings for any sensible use of the "Reply-To" header. (The only use of this header is to be set to a different email from the sender email.)
As I'm sure you are aware, this type of false warning is bound to cause the "cry-wolf effect". This teaches users to ignore warnings which significantly undermines phishing security. Please consider removing the "Reply-To" check altogether.

Related to issue: #9453

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.