emails rejected from various Linux based systems due to perceived header syntax failure when using distribution lists

Question

What am I missing...

Given: Linux-stack based email server system (hosted) with webmail component. Various email clients and other webmail systems involved and tested with this.

We are distributing emails via distribution lists using the webmail client. The mail system sends emails similar to the following example (copy from source email header). Where organisation is the name of a distribution list:

Date: Sat, 20 Apr 2024 18:35:45 +0200
Message-ID: <[email protected]>
From: [email protected]
To: organisation: [email protected], [email protected];
Subject: here goes the subject

So far so good, emails are delivered OK (even to GMX mailboxes) and no "undeliverable email" message is received.

Issue

Next replying "to all" from certain email clients or webmail systems (e. g. GMX webmail) are resulting in obviously misformed headers (while using e. g. Thunderbird produces a correct format). Those replies are rejected by certain systems; example message:

Your e-mails have been rejected by our mail system because the information provided in the e-mail header does not comply with the specifications in RFC 5322 and RFC 2047. The header field "To" is syntactically not correct.

The email header in question looks like this (pls. pay particular attention to To: line):

Received: from ...
Reply-To: ...
From: <[email protected]>
To: <[email protected]>, <organisation: [email protected]>;
References: <[email protected]>
In-Reply-To: <[email protected]>
Subject: AW: here goes the subject

Obviously certain mail clients are interpreting the supplied name of the distribution list as part of the email address of the first addressee.

The questions at hand are: (1) Who is the culprit? (2) What is the correct format? (3) Is the server distributing the original message not following certain RFC's or is this a failure in a mail client or mail system?

===== final edit =====

This apparently is a bug in Horde. Ticket raised.

Answer 1

(this is probably wrong but left as-is since there's some useful discussion below)

Where organisation is the name of a distribution list:

Whatever is generating the original email is at fault here. Mailbox names (the bit before @domain) can contain spaces, @ characters and all sorts of other weird stuff. So the forwarding is correctly interpreting the first entry from the To: header as "organisation: [email protected]".

I'd need to do a lot of reading to determine if a space explicit requires quoting or escaping (the '@' character in a mailbox name does). So I can't tell you if the error claiming this is not RFC compliant is accurate - however this point is moot since even if it were not required, this is not the behaviour you intend.

Answer 2

RFC 5322 is the current specification for Group Addresses. They are explained in Appendix A.1.3, where it writes,

From: Pete <[email protected]>
To: A Group:Ed Jones <[email protected]>,[email protected],John <[email protected]>;
[…]

In this message, the To: field has a single group recipient named "A Group", which contains 3 addresses […]

The address specification is formally defined in section 3.4, and from here I'm going to pick out only the relevant parts:

3.4. Address Specification

An address may either be an individual mailbox, or a group of mailboxes.

group           =   display-name ":" [group-list] ";" [CFWS]
group-list      =   mailbox-list / CFWS
mailbox-list    =   (mailbox *("," mailbox))
mailbox         =   name-addr / addr-spec
name-addr       =   [display-name] angle-addr
angle-addr      =   [CFWS] "<" addr-spec ">" [CFWS]

and

3.4.1. Addr-Spec Specification

An addr-spec is a specific Internet identifier that contains a locally interpreted string followed by the at-sign character ("@", ASCII value 64) followed by an Internet domain. […] Comments and folding white space SHOULD NOT be used around the "@" in the addr-spec.

addr-spec       =   local-part "@" domain
local-part      =   dot-atom / quoted-string
domain          =   dot-atom / domain-literal

and

3.2.3. Atom

dot-atom        =   [CFWS] dot-atom-text [CFWS]

I have omitted the obs-* entries here that exist in RFC 5322's formal specification as they reference obsolete patterns. CFWS indicates that comments and/or folding white-space are permitted.

Accordingly, both of these formats should be accepted by the definition of group-list:

A Group:Ed Jones <[email protected]>,[email protected],John <[email protected]>;
A Bare Group:[email protected],[email protected],[email protected];

Applying this interpretation to your own group list, I would say that what you have is valid:

To: organisation: [email protected], [email protected];

and, therefore, it is the recipient systems that are at fault. (Or an intermediate system with aggressive header rewriting. If you send your emails through firewall appliance or your clients receive them through one I'd be checking that.)