开云体育

That level of filtering is done at Groups.io as well.

In the case at hand the spoofed message had an "envelope-from" (the "mail from" provided at connection time in the SMTP protocol) that matched the domain that delivered the message. As such it would also have been accepted by Yahoo Groups also.

However the header-from (the from field provided inside the message header) was spoofed to match the subscription address of the group's owner. This form of spoof is not rejected (by either service) because it is too often used legitimately by people who use email forwarding services.

Shal