Merge pull request #23 from simple-login/spf-check

Spf check

app/email_utils.py

@@ -208,5 +208,7 @@ def add_or_replace_header(msg: Message, header: str, value: str):
 
 
 def delete_header(msg: Message, header: str):
-    if msg[header]:
-        del msg[header]
+    """a header can appear several times in message."""
+    for h in msg._headers:
+        if h[0].lower() == header.lower():
+            msg._headers.remove(h)

email_handler.py

@@ -110,7 +110,7 @@ class MailHandler:
 
         gen_email = GenEmail.get_by(email=alias)
         if not gen_email:
-            LOG.d("alias %s not exist")
+            LOG.d("alias %s not exist", alias)
 
             # check if alias is custom-domain alias and if the custom-domain has catch-all enabled
             alias_domain = get_email_domain_part(alias)
@@ -264,6 +264,9 @@ class MailHandler:
             msg, "List-Unsubscribe-Post", "List-Unsubscribe=One-Click"
         )
 
+        # Received-SPF is injected by postfix-policyd-spf-python can reveal user original email
+        delete_header(msg, "Received-SPF")
+
         LOG.d(
             "send email from %s to %s, mail_options:%s,rcpt_options:%s",
             alias,