Using Reply-To incorrectly triggers phishing warning
@DerDreschner is already working on this.
Since Jan 9, 2026.
- Dominant language
- JavaScript
- Stars
- 1k
- Forks
- 348
- Avg merge
- 12h 28m
- Merged PRs (30d)
- 91
Description
Steps to reproduce
Send email with the Reply-To header set (to anything except for the sender email).
Expected behavior
No warning should occur, since the whole purpose of the Reply-To header is to inform clients that "responses should be addressed to a different mailbox"^1.
Actual behavior
The mail app claims that "This email might be a phishing attempt", stating that the "Reply-To email: [...] is different from sender email: [...]".
Mail app version
5.6.4 (current), affecting all versions after commit 9b87b23/v4.0.0-alpha1
Nextcloud version
No response
Mailserver or service
No response
Operating system
No response
PHP engine version
None
Nextcloud memory caching
No response
Web server
None
Database
None
Additional info
This issue was introduced by commit 9b87b23, which merged the corresponding PR #9610. @kesselb mentioned this in a comment which was unfortunately not further discussed.
Unfortunately, the "Reply-To" check (as currently implemented) issues spurious phishing warnings for any sensible use of the "Reply-To" header. (The only use of this header is to be set to a different email from the sender email.)
As I'm sure you are aware, this type of false warning is bound to cause the "cry-wolf effect". This teaches users to ignore warnings which significantly undermines phishing security. Please consider removing the "Reply-To" check altogether.
Related to issue: #9453
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.