I would like to know if it's still possible to spoof an address from, for example, [email protected] when sending to Gmail. I've tried sending a spoofed e-mail to other mail service and it performs the spoof successfully.
What I am missing?
It will depend on whether the spoofed domain has an SPF policy and other factors internal to Gmail spam filters.
With a strict SPF policy on the domain it shouldn't be possible at all.
With strict DKIM it shouldn't be possible either.
With neither, it might still get filtered by Gmail (or other providers) depending on the originating host address, its configuration and probably other factors the big providers weigh in.
Getting filtered could mean it will land in the user's spam folder, it will be silently dropped, or it will be rejected during the SMTP session with the sender host.
First up.. my experience: Im a penetration tester with a lot of phishing simulations under my belt, a lot of which have been targeted at organisations using (hiding behind) Gmail/GSuite.
Gmail's algorithm for spam detection is proprietary. Although we can infer a number of things from mail that was sent and if it landed in the inbox:
Honestly, there are probably a hundred levels of validation on mail sent to GSuite/GMail.
However, the most crucial one in my line of work is that it looks at the level of user engagement. For example, if a spam email is sent to 10,000 people, none of who click and links and some people flag. The sending address/IP are basically dead to Google. But if you just want to send a spoofed message to a single target, or a select few.. these may get through as Google needs some level of data to work with. It would fundamentally be wrong for Google to just start dropping your mail because it had a light hunch that it was spam.
In short, GMail's defences are great, but they are designed to keep your inbox clean from the junk that gets fired to tens of thousands of people.. it is not a silver bullet if you are targeted specifically.