End of mail spoofing?

Question

I've made the simpliest e-mail program in C#.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;

using System.Net.Mail;

namespace Sending_Email
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            try
            {
                SmtpClient client = new SmtpClient(sendServer.Text);

                MailMessage message = new MailMessage(from.Text, to.Text);

                client.Port = System.Convert.ToInt32(port.Text);

                message.Subject = subj.Text;

                message.Body = contentBox.Text;

                client.Send(message);
            }
            catch (Exception ex)
            {
                MessageBox.Show("ERROR: " + ex.Message);
            }       

        }

    }
}

How it looks in practice:

Why it tells something about authentication? I was sure SMTP doesn't have it and the mail spoofing problem attest to this fact.

The error is the same with all SMTP servers, smtp.google.com was only an example.

Does it mean that now it's impossible to send fake emails, or I'am wrong?

Answer 1

Email spoofing is the act of sending an email that looks as though it came from someone else.

When I send an email I connect to an SMTP server and tell it who to send to, who is sending it, and what to send. The SMTP server may require authentication (if it doesn't then it's considered an open relay and anyone can send whatever they want). This authentication proves that I am who I say I am to that particular SMTP server and no one else. If I connect to an open relay SMTP server and tell it to send an email I can tell it who I want it to send as. This is how spoofing works.

There are ways to validate that a message did come from someone in particular, but there is no single ratified solution that everyone agrees on, and each solution requires varying degrees of configuration.

The particular error you are receiving is the result of not connecting to the right port and telling it to encrypt the connection (which really only prevents people from eavesdropping on the message). Also, I'm assuming Google requires that users authenticate so those sending from Gmails SMTP server are at least verified as Gmail users. If I wanted to spoof something I wouldn't use a server that requires authentication.

Answer 2

Have you tried sending this to port 25* instead of port 587? The error message you are getting seems to tell you the problem -- you aren't setting up a TLS connection first. Encrypting the connection doesn't prevent spam, it just makes the transmission of data to the first leg of the email's journey more secure.

*Note that gmail does not use port 25. You'll have to try another SMTP server.