Python email parsing: inspect all sender headers before trusting one

Last updated: 1 Oct 20265 min read

tutorial

A parsed message may retain repeated sender headers; single-value access hides that multiplicity.

Operation contract

A controlled byte message has two From fields. BytesParser retains both, and the application rejects it when the count differs from one. A separate single-sender message passes the same count check. Parsing is explicit about its policy.

Failure boundary

The fixture does not authenticate a sender, verify a signature, or decide mail delivery. A unique From field is only one structural rule. Full mail ingestion also needs byte limits, defect handling, MIME part budgets, and an identity policy independent of header text.

Working program

from email import policy
from email.parser import BytesParser

parser = BytesParser(policy=policy.default)
repeated = parser.parsebytes(
    b"From: receipts@aitrove.in\r\nFrom: audit@aitrove.in\r\n"
    b"Subject: R-47\r\n\r\npaid\r\n"
)
single = parser.parsebytes(
    b"From: receipts@aitrove.in\r\nSubject: R-73\r\n\r\npaid\r\n"
)
print("repeated_count", len(repeated.get_all("From", [])))
print("repeated_rejected", len(repeated.get_all("From", [])) != 1)
print("single_accepted", len(single.get_all("From", [])) == 1)

Output

repeated_count 2
repeated_rejected True
single_accepted True

Costs and limits

Parsing a complete message retains its body and header structure in memory. A production reader needs a byte budget before parsebytes and a part policy afterward.

Common Mistakes

message['From'] may conceal a repeated field; use get_all for a uniqueness rule.
A syntactically valid address is not authenticated identity.
Do not assume parsing alone rejects every malformed MIME tree.

Connected lessons

Test this contract.

python

email-duplicate-headers