Why doesn't sendmail validate credentials before sending out a mail

Question

I am using the following code:

cat - emailbody.txt <<EOF | /usr/sbin/sendmail -oi -t
From: <PersonB@xyz.com>
To: <PersonA@xyz.com>
Subject: Testmail
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
EOF

where emailbody.txt is a file with the contents of the email and PersonB@xyz.com and PersonA@xyz.com are both valid email addresses. My question is, that when I run this command, sendmail executes successfully and sends a mail to PersonA@xyz.com. However at no point does it ask for the credentials of PersonB@xyz.com. Shouldn't that check be executed before the mail is sent out? What prevents me from impersonating another person's email address to send out false mails. Is there a rationale for this behavior?

Answer 1

Because you are not actually sending from that email, it is just the header you are modifying so it shows that address in your email client. For instance, you could put that and put in a "Friendly Name" as "Santa Claus" and it will show it as that name, which will make it appear as a contact.

Your email will likely flag as spam from some strict mail filters.

If you browse the original / message source. (ie. in gmail - click the drop down on the top right and select Show Original)

There will be a line that says: Received: from [mail-server] ([mail-server] [server-ip] - If the email is coming from a gmail address, but the mail-server is not one of google's that can indicate something wrong. But likely most ESPs will capture this.

Modifying the objects in the header is how phishing emails manage to get information from some less knowledgeable individuals.