You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Use the sender's domain in Message-ID instead of SendLit's host #49
generateRfcMessageId() (utils/rfc-message-id.ts:14-22) always uses SendLit's host (getSiteUrl(), or sendlit.local as a fallback) on the right-hand side of Message-ID, whatever the From domain is.
Why it matters: RFC 5322 §3.6.4 expects a globally unique id, and the convention is to use the sender's domain. A domain that doesn't match From (or localhost/sendlit.local when self-hosted) is a weak spam signal, and it exposes the platform host on white-labelled sends.
Proposed fix
Change the function to generateRfcMessageId(fromDomain).
Activity