I'm trying to understand how email spoofing works. After studying the technical process, I have finally understood that:
The spoofer will try to scan every port of an SMTP server to catch the MX
Connect with telnet to the MX server
Send the SMTP packet changing the FROM and TO in the envelope
However, as it is explained in this post, it is not that easy. You have for example to look for an SMTP server that will not reject the telnet connection attempt considering that I don't even know how you can find the smtp servers (they must be protected from port scanning I guess). And there are other issues.
Therefore, I'm wondering how websites such as "emkei" can so easily propose to spoof an email.
Does it try all the SMTP server really fast?
Or does it host its own SMTP server that will relay the packet? In that case, if for example, it tries to send a mail from
email@example.com, it will have to route it to a Gmail SMTP server, and this one could reject any Gmail address that does not come from another Gmail SMTP server. And if they used an Open-Relay server, the server would have been blacklisted, right?
I really don't see how it can work.