dealing with headers that affect how a message is replied to or bounced

[dkg]

there are non-user-facing headers that are actionable during reply (e.g. that shift the behavior of the MUA somehow), like Reply-To and Mail-Followup-To. (and maybe Sender and Return-Path) ?

I worry that if we don't call these out specifically, then we are vulnerable to (at least) recipient-modification attacks.

I'm not sure how to characterize or exhaustively enumerate all such headers, or where in the spec such a mention belongs. The concept is subtly different from user-facing headers.

[dkg]

(see https://cr.yp.to/proto/replyto.html about Mail-Reply-To and Mail-Followup-To)

There is also Followup-To.

It's possible that Reply-To and Followup-To should themselves be labeled as "user-facing" as well. At least Thunderbird displays them to the user.

[dkg]

I've included Reply-To and Followup-To as user-facing headers (because they are actually user-facing). But i am still concerned that there may be other headers that affect how replies are done but aren't actually user-facing, and we might want to handle them differently.