7

I use Gmail. When I receive an email, Gmail displays the sender's email address. So far I've always looked at this address when receiving sensitive mails, to avoid phishing. For example, I know by heart that PayPal's site is paypal.com so I just check that the email indeed comes from a paypal.com address. I always thought this is sufficient as a security measure.

Now, though, I read the "Authentication icon for verified senders" Gmail support article. It seems to say that my described practice is not enough and I should also enable the mentioned "lab" and look for the "key" icon every time.

My question is, why should I do that?

Improve this question
1
  • I get mails with genuine paypal addresses in the From field pretty regularly, though I've never had an account with them.
    – Jon Hanna
    May 10, 2016 at 0:00

3 Answers 3

Reset to default
11

Email is a very old plain-text protocol (dating from the 1970s/1980s).

Anyone who controls a mail-server can send out mail from their mailserver using any return address (including ones at other domain). SMTP doesn't include any checks that the mail came from a mail server who controlled the domain listed on the From: line.

Extensions to email protocols exist to help prevent this email spoofing problem (see specifically DKIM, SPF, DMARC).

Bottom line, you can't naively trust the From line in an email.

Improve this answer
1
  • 1
    dr jimbob, it is not necessary to control a mail-server. E-mail can be sent by a simple telnet session from any machine with telnet capability.
    – Ron Jensen
    May 16, 2017 at 19:11
0

Every email message has sender email address in the header as well in the message. The one you can see in email client is the one in message, and there could be anything what is configured in email client on the sender side.

The real sender address is only in the header, so if you find out how to view the headers in you email client, there should be real sender address, as well the ip address of the server from which it was received.

The same email address which is in header is also used for auto-replying (e.g. from mail server with message "recipient not found" etc), but when you click "reply" in email client, the new composed message will be addressed and sent to the address specified originally in message.

It also depends on the email servers if it will decide to put the original sender address in the header of the finally delivered message and in which place exactly. You can try changing your email address in your email client and try sending emails and see how it works. For example, you can specify instead your [email protected] something else (username, domain), and send email to yourself, and check the headers.

See RFC2821 for details: https://www.ietf.org/rfc/rfc2821.txt

Improve this answer
1
  • 3
    The sender address in the header can be set to anything as well. All you need is a single untrustworthy or compromised SMTP server.
    – Neil Smithline
    May 10, 2016 at 2:45
0

To have the receiver verify the sender and the message, both parties can agree to use S/MIME certificates. You can purchase these at your internet provider.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .