Skip to main content
Information Security

Return to Answer

replaced http://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
Source Link
Community Bot
Community Bot
  • 1

I'll try to answer to your second question: how to detect fake (spoofed) e-mails.

All you need is to take a look at your e-mail headers. Received will tell you about the route, which message took to get to you. You should read that headers in reverse orders. If Received headers consist of server-names not related to the e-mail domain, then you probably received spoofed e-mail. Let's assume that we got e-mail from [email protected] and we want to check if it's a fake or not. The easiest (and usually effective) method is checking MX records: host -t MX stackexchange.com and comparing them with Received headers.

Another method to avoid spoofed e-mails is using mail-serves which implemented Sender Policy Framework (you can read more about it here: http://tools.ietf.org/html/rfc4408https://www.rfc-editor.org/rfc/rfc4408) or DomainKeys Identified Mail.

By examining e-mail headers you can determine if sent e-mail is spoofed or not, but you cannot trace the sender's IP address. However, there are some exceptions. The stuff which you can find inside the e-mail headers depends on the e-mail facility used. Some web-email-servers implementations have additional headers. The example is X-Originator-IP which COULD store the IP address of the computer which sent e-mail.

I'll try to answer to your second question: how to detect fake (spoofed) e-mails.

All you need is to take a look at your e-mail headers. Received will tell you about the route, which message took to get to you. You should read that headers in reverse orders. If Received headers consist of server-names not related to the e-mail domain, then you probably received spoofed e-mail. Let's assume that we got e-mail from [email protected] and we want to check if it's a fake or not. The easiest (and usually effective) method is checking MX records: host -t MX stackexchange.com and comparing them with Received headers.

Another method to avoid spoofed e-mails is using mail-serves which implemented Sender Policy Framework (you can read more about it here: http://tools.ietf.org/html/rfc4408) or DomainKeys Identified Mail.

By examining e-mail headers you can determine if sent e-mail is spoofed or not, but you cannot trace the sender's IP address. However, there are some exceptions. The stuff which you can find inside the e-mail headers depends on the e-mail facility used. Some web-email-servers implementations have additional headers. The example is X-Originator-IP which COULD store the IP address of the computer which sent e-mail.

I'll try to answer to your second question: how to detect fake (spoofed) e-mails.

All you need is to take a look at your e-mail headers. Received will tell you about the route, which message took to get to you. You should read that headers in reverse orders. If Received headers consist of server-names not related to the e-mail domain, then you probably received spoofed e-mail. Let's assume that we got e-mail from [email protected] and we want to check if it's a fake or not. The easiest (and usually effective) method is checking MX records: host -t MX stackexchange.com and comparing them with Received headers.

Another method to avoid spoofed e-mails is using mail-serves which implemented Sender Policy Framework (you can read more about it here: https://www.rfc-editor.org/rfc/rfc4408) or DomainKeys Identified Mail.

By examining e-mail headers you can determine if sent e-mail is spoofed or not, but you cannot trace the sender's IP address. However, there are some exceptions. The stuff which you can find inside the e-mail headers depends on the e-mail facility used. Some web-email-servers implementations have additional headers. The example is X-Originator-IP which COULD store the IP address of the computer which sent e-mail.

Source Link
p____h
p____h
  • 1.6k
  • 7
  • 11

I'll try to answer to your second question: how to detect fake (spoofed) e-mails.

All you need is to take a look at your e-mail headers. Received will tell you about the route, which message took to get to you. You should read that headers in reverse orders. If Received headers consist of server-names not related to the e-mail domain, then you probably received spoofed e-mail. Let's assume that we got e-mail from [email protected] and we want to check if it's a fake or not. The easiest (and usually effective) method is checking MX records: host -t MX stackexchange.com and comparing them with Received headers.

Another method to avoid spoofed e-mails is using mail-serves which implemented Sender Policy Framework (you can read more about it here: http://tools.ietf.org/html/rfc4408) or DomainKeys Identified Mail.

By examining e-mail headers you can determine if sent e-mail is spoofed or not, but you cannot trace the sender's IP address. However, there are some exceptions. The stuff which you can find inside the e-mail headers depends on the e-mail facility used. Some web-email-servers implementations have additional headers. The example is X-Originator-IP which COULD store the IP address of the computer which sent e-mail.