Include email source data when forwarding spam to [Agency/Gov] reporting addresses

[Paul-]

Feature Request: When a user reports spam to an official agency (e.g., report@phishing.gov.uk), Thunderbird should automatically detect the endpoint using pattern matching and prompt the user to forward the message as an attachment (.eml format) rather than inline, preventing the loss of critical routing headers like DKIM, SPF, and Received: chains necessary for cyber investigators. This logic could either intercept a manual forward with a prompt asking to attach the original source data, or as an alternative, it could be integrated directly into Thunderbird’s existing "Spam / Junk" button to automatically package and auto-route the pristine email source data to the designated agency upon click.

Thunderbird 

[Jon]

Thanks for submitting an idea to the Mozilla Connect community! Your idea is now open to votes (aka kudos) and comments.

[Paul-]

I’m adding a quick follow-up to my request with a specific example of why having automated header inclusion is so critical.

I just identified a filter-evasion tactic where the deceptive links don't point to external malicious URLs at all. Instead, the hidden hyperlink structure uses a localized mail loop pointer, looking like this: imap://imap.examplemail.com:993/fetch>fetch>uid>00000#.

This is exactly why my feature proposal matters: without automated header analysis, isolating the true origin of a local loop string like this is incredibly difficult for standard investigations.

Unless there is a legitimate, architectural reason for inbound mail to ever contain raw internal IMAP commands like this, being able to automatically extract and parse the headers is precisely how the system can identify and stop these types of bypasses.