0

I am using the following code:

cat - emailbody.txt <<EOF | /usr/sbin/sendmail -oi -t
From: <PersonB@xyz.com>
To: <PersonA@xyz.com>
Subject: Testmail
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
EOF

where emailbody.txt is a file with the contents of the email and PersonB@xyz.com and PersonA@xyz.com are both valid email addresses. My question is, that when I run this command, sendmail executes successfully and sends a mail to PersonA@xyz.com. However at no point does it ask for the credentials of PersonB@xyz.com. Shouldn't that check be executed before the mail is sent out? What prevents me from impersonating another person's email address to send out false mails. Is there a rationale for this behavior?

Improve this question
1
  • The Internet was vastly smaller and vastly more trusting when SMTP was designed, so no, there is no check or validation required, and anyone can send mail as if from any mail address. These days they'd run afoul various anti-spam or other such add-on rules, depending on the forgery attempted, what mail servers the message goes through, etc.
    – thrig
    Mar 9 '16 at 21:35
0

Because you are not actually sending from that email, it is just the header you are modifying so it shows that address in your email client. For instance, you could put that and put in a "Friendly Name" as "Santa Claus" and it will show it as that name, which will make it appear as a contact.

Your email will likely flag as spam from some strict mail filters.

If you browse the original / message source. (ie. in gmail - click the drop down on the top right and select Show Original)

There will be a line that says: Received: from [mail-server] ([mail-server] [server-ip] - If the email is coming from a gmail address, but the mail-server is not one of google's that can indicate something wrong. But likely most ESPs will capture this.

Modifying the objects in the header is how phishing emails manage to get information from some less knowledgeable individuals.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.