1

I would like to know if it's still possible to spoof an address from, for example, no-reply@company.com when sending to Gmail. I've tried sending a spoofed e-mail to other mail service and it performs the spoof successfully.

What I am missing?

4

It will depend on whether the spoofed domain has an SPF policy and other factors internal to Gmail spam filters.

With a strict SPF policy on the domain it shouldn't be possible at all.

With strict DKIM it shouldn't be possible either.

With neither, it might still get filtered by Gmail (or other providers) depending on the originating host address, its configuration and probably other factors the big providers weigh in.

Getting filtered could mean it will land in the user's spam folder, it will be silently dropped, or it will be rejected during the SMTP session with the sender host.

4

First up.. my experience: Im a penetration tester with a lot of phishing simulations under my belt, a lot of which have been targeted at organisations using (hiding behind) Gmail/GSuite.

Gmail's algorithm for spam detection is proprietary. Although we can infer a number of things from mail that was sent and if it landed in the inbox:

  • It doesnt like mail that has headers in a weird order.
  • It doesnt like some headers fullstop (such as the 'X-*' headers).
  • It can check how long a domain has been registered. The longer, the better.
  • It checks the DMARC validation (if you are spoofing a site with a strong DMARC policy GMail will drop it. There is nothing you can do about that beyond compromising an allowed mailserver).
  • It checks that the reply-to or return-to values are of the same origin as the FROM address.
  • It looks for keywords.
  • It looks at the links and image domains. I believe it goes as far as to detect mutations to domains... eg. spoofing FROM jobs@apple.com but linking to www.aple.com
  • It looks at attachments.

Honestly, there are probably a hundred levels of validation on mail sent to GSuite/GMail.

However, the most crucial one in my line of work is that it looks at the level of user engagement. For example, if a spam email is sent to 10,000 people, none of who click and links and some people flag. The sending address/IP are basically dead to Google. But if you just want to send a spoofed message to a single target, or a select few.. these may get through as Google needs some level of data to work with. It would fundamentally be wrong for Google to just start dropping your mail because it had a light hunch that it was spam.

In short, GMail's defences are great, but they are designed to keep your inbox clean from the junk that gets fired to tens of thousands of people.. it is not a silver bullet if you are targeted specifically.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.