title: How to verify email sender address is not spoofed?
body: <p>As per <a href="https://stackoverflow.com/questions/1840858/how-to-verify-sender-of-incoming-email-address-in-google-app-engine">this question</a> I asked previously on Google App Engine, if I have access to all the information in a standard email, not just the <code>From</code>, <code>To</code>, <code>Subject</code>, <code>Body</code> fields, but also all the headers and MIME information, how can I verify that two incoming emails with the same <code>From</code> address are actually from the same sender. </p>
  
  <p>What I've considered thus far:</p>
  
  <ul>
  <li>Check the IP address of the email's sending server</li>
  <li>Check the DNS records of the email's sending server</li>
  <li>Verify the sending agent of the email (i.e. web interface, Outlook, Thunderbird, etc)</li>
  <li>Check the reply-to field</li>
  <li>Etc. </li>
  </ul>
  
  <p>I realize this is a complicated question (I'm sure companies like Posterous have spent tons of time on this problem). I'm just looking for a few criteria to get started preliminarily. Thanks!</p>
  
  <p><strong>Update:</strong></p>
  
  <p>The answers so far are really helping, but just to help them out, the context of my project is that I would be <em>receiving</em> tons and tons of email as a web app from my users. They would use their email as the primary way of inputting data into my system. This I why I made the Posterous analogy. The use case is very similar. </p>