Tracing the email sent from SMTP

Question

How can someone be traced over email/SMTP, if they connect via telnet to SMTP and send and email.

I know that email can be spoofed with this method, but how secure it really is? Can I see who was loged via telnet or who send an email via telnet?

I saw this method for "spoofing" emails here.

Answer 1

I assume you mean by 'tracing' that one can determine your location. Your location can be determined by the network address.

There are several ways to determine your network address whilst connecting to an smtp server via telnet:

1. The owner of the smtp server can log all activity, including your network address.
2. Intermediate nodes between you and the smtp server can log your network address.
3. On the receiver side, the e-mail you spoofed will contain your network address in the Received header.

Answer 2

Normal SMTP servers add headers indicating where they receive the mail from to allow the final recipient to control whether the mail seems legit or fraudulous.

Said differently, it is easy to fake any field in an email, but you cannot fake the fields that will be added by the servers you will use.

Open relays are frowned upon and will soon be rejected by other servers, so normaly you should be authenticated at the first server, either with a normal authentication (username + password) or simply with your IP address if you are in a private network or in an ISP network.

I you receive an e-mail that looks weird you should scrutinize all the headers to identify all the relays and the first sender If the first sender is unrelated to the From: address, the mail is likely to be fake.