HackBlue

Tools · Email security · 25 / 26

In-Reply-To does not prove the parent exists

In-Reply-To cites an id. A mailbox search is a separate result. Write both, and do not assume the parent is stored.

10 min read · practice only with authorization

The header cites an id

In-Reply-To carries an angle-bracket id the creating software offered as the parent. References may list more ids. Those strings are claims in the header. They are not a search result.

A client may group messages into a thread from these headers. The grouping is a display. It does not prove you already hold the parent, and it does not prove anyone on your side wrote it.

What the case file can claim

Write the cited id and the search outcome: found, not found, or not run. Name the mailbox the search covered. Do not say the parent was verified when the search was not run.

Lab: a cited parent the mailbox does not hold

A lab message has In-Reply-To <lab-100@mail-out.example>. A search of the lab mailbox for that id returns no copy. A draft says the user already received the parent because the header names it, and treats the thread as verified.

The note quotes the cited id and says the lab-mailbox search found nothing. The header claim stays a claim. The thread is not marked verified.

Snippet
In-Reply-To: <lab-100@mail-out.example>
search: lab mailbox
result: no copy
write: cited id and a miss
not: parent already received

Diagram

A cited id and a search are different notes

The header can name a parent you do not hold.

  • Cited id

    The angle-bracket string in In-Reply-To. Quote it.

  • Search hit

    A copy found in the mailbox you named.

  • Search miss

    That search found nothing. The header is unchanged.

  • Search not run

    Say so. Do not call the thread verified.

Check yourself

1. In-Reply-To contains <lab-100@mail-out.example>. What is that string?

2. A search of the lab mailbox finds no copy of that id. What do you have?

3. You have not searched. What do you write?