Referencing https://docs.google.com/spreadsheets/d/1jkb_ZybbAoUA43K902lL-sB7c1HMQ78-fhQ8nowJCQk/htmlview?sle=true

Mailbird is not vulnerable to Mailsploit or spoofing, which means you'll be able to either see some or all of the additional characters used for spoofing, in the sender name or email address, or see the actual sender email via hovering the sender on the email in Mailbird.

If using IMAP you also have the option of seeing the raw message source of any message, showing server relay information among other things that can help you determine whether an email can be trusted or not.

Regarding code injection; Mailbird is listed as vulnerable, but that should not be the case as no part of the headers are shown in a browser window and we've been unable to confirm an issue internally. We have reached out to the author of Mailsploit.com for more details on how he came to that conclusion. Unfortunately the support ticket opened by him originally was classified as spam - so it did not come to our attention until Mailsploit was made public. If it turns out Mailbird is indeed vulnerable to code injection, we will of course fix it immediately and send out an update.

If you have any further questions feel free to open a ticket and we will get back to you as soon as possible.

--

For more information on Mailsploit and why it's not the end of the world:

https://www.agari.com/mailsploit-dmarc-sky-not-falling-2/