I am using the following code:

cat - emailbody.txt <<EOF | /usr/sbin/sendmail -oi -t
From: <[email protected]>
To: <[email protected]>
Subject: Testmail
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0

where emailbody.txt is a file with the contents of the email and [email protected] and [email protected] are both valid email addresses. My question is, that when I run this command, sendmail executes successfully and sends a mail to [email protected]. However at no point does it ask for the credentials of [email protected]. Shouldn't that check be executed before the mail is sent out? What prevents me from impersonating another person's email address to send out false mails. Is there a rationale for this behavior?

  • The Internet was vastly smaller and vastly more trusting when SMTP was designed, so no, there is no check or validation required, and anyone can send mail as if from any mail address. These days they'd run afoul various anti-spam or other such add-on rules, depending on the forgery attempted, what mail servers the message goes through, etc.
    – thrig
    Mar 9, 2016 at 21:35

1 Answer 1


Because you are not actually sending from that email, it is just the header you are modifying so it shows that address in your email client. For instance, you could put that and put in a "Friendly Name" as "Santa Claus" and it will show it as that name, which will make it appear as a contact.

Your email will likely flag as spam from some strict mail filters.

If you browse the original / message source. (ie. in gmail - click the drop down on the top right and select Show Original)

There will be a line that says: Received: from [mail-server] ([mail-server] [server-ip] - If the email is coming from a gmail address, but the mail-server is not one of google's that can indicate something wrong. But likely most ESPs will capture this.

Modifying the objects in the header is how phishing emails manage to get information from some less knowledgeable individuals.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .