Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've made the simpliest e-mail program in C#.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;

using System.Net.Mail;

namespace Sending_Email
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            try
            {
                SmtpClient client = new SmtpClient(sendServer.Text);

                MailMessage message = new MailMessage(from.Text, to.Text);

                client.Port = System.Convert.ToInt32(port.Text);

                message.Subject = subj.Text;

                message.Body = contentBox.Text;

                client.Send(message);
            }
            catch (Exception ex)
            {
                MessageBox.Show("ERROR: " + ex.Message);
            }       

        }

    }
}

How it looks in practice:

enter image description here

Why it tells something about authentication? I was sure SMTP doesn't have it and the mail spoofing problem attest to this fact.

The error is the same with all SMTP servers, smtp.google.com was only an example.

Does it mean that now it's impossible to send fake emails, or I'am wrong?

share|improve this question
    
Obviously it's on the port which requires TLS or authenticated user, just as it says. –  Andrew Smith Jul 12 '12 at 23:04
add comment

2 Answers

up vote 1 down vote accepted

Email spoofing is the act of sending an email that looks as though it came from someone else.

When I send an email I connect to an SMTP server and tell it who to send to, who is sending it, and what to send. The SMTP server may require authentication (if it doesn't then it's considered an open relay and anyone can send whatever they want). This authentication proves that I am who I say I am to that particular SMTP server and no one else. If I connect to an open relay SMTP server and tell it to send an email I can tell it who I want it to send as. This is how spoofing works.

There are ways to validate that a message did come from someone in particular, but there is no single ratified solution that everyone agrees on, and each solution requires varying degrees of configuration.

The particular error you are receiving is the result of not connecting to the right port and telling it to encrypt the connection (which really only prevents people from eavesdropping on the message). Also, I'm assuming Google requires that users authenticate so those sending from Gmails SMTP server are at least verified as Gmail users. If I wanted to spoof something I wouldn't use a server that requires authentication.

share|improve this answer
add comment

Have you tried sending this to port 25* instead of port 587? The error message you are getting seems to tell you the problem -- you aren't setting up a TLS connection first. Encrypting the connection doesn't prevent spam, it just makes the transmission of data to the first leg of the email's journey more secure.

*Note that gmail does not use port 25. You'll have to try another SMTP server.

share|improve this answer
    
My ISP has blocked port 25. –  0x6B6F77616C74 Jul 12 '12 at 21:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.