Vortices of Extelligence

Outlook 2003's Message-Id insanity

So $REALJOB_COMPANY deploys a Windows-based intranet - Active Directory, Exchange, Web components, all that jazz. So far so good, except when a cow-orker asked about spam handling, the boss (who is actually a truly-non-PHB, and who actually engineered the new network infrastructure) replied that spam handling might be solved when we migrate to using MS Outlook 2003 and its spam filters, but... But, he said, Outlook 2003 had a slight problem: it could sometimes send out messages without including a Message-Id header! So we're waiting for Microsoft to fix that, and then we'll migrate.

I could scarcely believe that, so seconds after the meeting there I was, googling for Outlook 2003 Message-Id, and sure enough, there it was: on the first page of results, a news bulletin which, among others, states that Outlook 2003 only includes Message-ID's when sending e-mail through an Exchange server. What really got my goat, though, was the reason for omitting the Message-Id header: you see, users complained that their machine names were visible on the Internet!

<F/X: spanner in works, mind grinding to abrupt halt, head exploding>

I wonder how the rest of the Internet, including the users of previous versions of Outlook and Outlook Express, have managed to cope with this horrible invasion of privacy - encoding the hostname in the Message-Id header - for the past nigh on 20 years! Its use in the In-reply-to and/or References headers, its perfect suitablility for indexing/searching an archive for messages, and lots of other characteristics just leave me lost for words. And even if the actual hostname is not used in the header, there are many algorithms to generate a hash or something based on the hostname - which would still go a long way towards the purpose of the hopefully-globally-unique Message-Id value.

Okay, so Outlook 2003 is indeed technically RFC-compliant, since RFC 2822 section 3.6.4, "Identification fields", does indeed say a message SHOULD (not MUST) have a Message-Id - but it does use the verb SHOULD and not MAY. Also, RFC 2821 allows the first or last SMTP server in the chain to add a Message-Id if none is present, but there are still many RFC-compliant SMTP servers out there which do not do so, and the client has absolutely no guarantees that a message will get a Message-Id header - and IMHO, every message should have one.

Oh well... score another one for muddy thinking. The end result? Outlook 2003 currently generates scores of messages that may very well be considered spam by many popular spam filters out there - and for a very, very good reason, too.

Posted by roam at January 27, 2004 03:54 PM