Get original e-mail sender server to circumvent spoofing

Question

I've posted this originally on SO, but it may as well be for here.

As you know, with many e-mail services, you can get tricked into believing an e-mail has been sent from a different address.

Using smtplib in Python, you can easily do the trick by manipulating the From argument.

gmail is not prone to that as they print the via argument which shows the original server.

However, what I cannot find anywhere is how do you retrieve the original (not manipulated) server name, the same as gmail does with their via functionality?

I've tried Python and its imaplib and email libraries, but there I can only access the already manipulated sender.

Any ideas?

Is that solely linked to the configuration of a particular provider (e.g. Google, Outlook, hotmail, etc.), or can something be done regardless of that - not only in Python, but perhaps in other languages, or in Kali?

Here is part of the code I'm currently using in Python (no success):

import imaplib
import email

obj = imaplib.IMAP4('imap', portn)
obj.login('username', 'password')

obj.select('INBOX')

uidl_list = [68720]

resp, data = obj.uid('FETCH', ','.join(map(str, uidl_list)) , '(BODY.PEEK[HEADER.FIELDS (From Subject)] RFC822.SIZE)')

I'm aware that this may be considered a duplicate, however in no other spoofing-related topics have I seen any discussion about how to tackle this.

That's perhaps because it is not possible, and it completely depends on the provider, but any clarification is nevertheless welcome.

Answer 1

First, Google does not know the original sender of the mail either. The original sender can only be known if the mail is signed by the actual sender using PGP or S/MIME and if the recipient can associate the key used for signing with a specific (usually the claimed) sender.

DKIM and SPF at least allow some approximation in that it can be checked if the claimed sender domain in the SMTP envelope is the correct one. But this envelope sender can be different from the claimed sender in the mails From header. With DMARC some kind of alignment of the domains between the envelope sender and the From header can be enforced. But, DKIM, SPF and DMARC need to be actually implemented for the senders domain, i.e. it works only if a domain owner explicitly implements method to protect his domain against getting used for spoofing. And of course it needs to be checked on the recipients side too. And it only checks the senders domain, not the sender inside the domain.

From my understanding of the description Gmail's via gets set if the sender from the SMTP envelope is a different one than the sender claimed in the From header. It will not be shown if both senders are the same, even if they are both spoofed. The envelope sender is usually added to the mail header as Return-Path header. Thus, to get a similar functionality as the via in Gmail just compare Return-Path with From header. But again, this does not necessarily show the real sender of the mail, since both envelope sender and From header can easily be spoofed.