What does the userid in received by header indicate?

Question

I have a Received header from an e-mail as follows:

Received: by aaa.bbb.ccc (Postfix, from userid 0)
    id A70248414D5; Sun, 26 Apr 2020 16:49:01 +0200 (CEST)

What does the userid part stand for? Is it the UID of the receiving postfix process? Is it the UID of the sender? How is it determined?

Note I have seen posts indicating that this is generated when using PHP's mail() function. I just can't seem to find details on how the uid is determined.

Thank you @davidgo. I was aware of that. That is why it caught my attention in the first place — John Nemo, May 01 '20 at 09:30

score 1 · Accepted Answer · answered May 01 '20 at 06:40

This doesn't indicate the mail was sent using PHP mail() function, as it's just one example of applications sending mail through Sendmail. It could be anything that utilizes Postfix's local submissions. From Postfix Architecture Overview: How Postfix receives mail:

Local submissions are received with the Postfix sendmail(1) compatibility command, and are queued in the maildrop queue by the privileged postdrop(1) command. This arrangement even works while the Postfix mail system is not running. The local pickup(8) server picks up local submissions, enforces some sanity checks to protect Postfix, and gives the sender, recipients and message content to the cleanup(8) server.

The pickup is aware of the user that used the postdrop.

postfix/pickup[4771]: A70248414D5: uid=0 from=<root>

The cleanup adds a unique message ID and a received header based on this information.

postfix/cleanup[4776]: cleanup_header_callback: 
    'Received: by example.com (Postfix, from userid 0)
       ??id A70248414D5; Sun, 26 Apr 2020 16:49:01 +0200 (CEST)'
postfix/cleanup[4776]: A70248414D5: message-id=<[email protected]>

The from literally means the user the message is from.

The userid 0 indicates it's from the root.

Thank you Esa. That was exactly the details I was looking for. I mentioned the PHP part, because I know for a fact that this e-mail was triggered by a web application (it was an order-confirmation). So seeing uid 0 (i.e. root) made me wonder if that could be used as an indicator that the application (or rather the process executing the PHP interpreter) was running as root. — John Nemo, May 01 '20 at 09:34
I thought this would be the correct level of detail for your needs. How the `pickup` gets this knowledge is another story. — Esa Jokinen, May 02 '20 at 15:05

What does the userid in received by header indicate?

1 Answers1