0

I have a domain for a website that I'm going to deploy soon. I've registered a gmail account, and let's say it is myWebsite@gmail.com. In order to look more professional, I decided to use gmail's "Send email as:" feature, and now I'm able to send emails as contact@myWebsite.com.

What I was very surprised to learn that there wasn't any validation that I own myWebsite.com domain. As a result, a couple of questions popped up in my mind.

  1. I guess other email providers provide the same functionality "Send email as:". Therefore, even if gmail tracks addresses that are being used, I'd guess that someone using yahoo email can easily set it up to send emails as contact@myWebsite.com and pretend to be me. What do you do about it ? How do you protect yourself in this case?

  2. What if a scammer pretends to be a bank ? It looks like it's very much possible to send an email as support@someBank.com. There must be some sort of protection against this?

  3. Is it probably better/safer to just use myWebsite@gmail.com and forget about custom email?

Thanks.

2
  • "... there wasn't any validation ..." - Based on this you would need to explicit add the address and you would need to provide the login credentials for the mail server of this domain. I've tried this and works as described. No idea what exactly you did. " ... that I own myWebsite.com domain ..." - You need to own a domain to have an email account there - you don't own gmail.com either but only have an email account there. Jun 3 at 22:42
  • @SteffenUllrich youtube.com/watch?v=e94AFnJybKg - I've followed this youtube tutorial and it doesn't look like you need all that that you specified.
    – Noob
    Jun 3 at 22:47
1

Let's start with, "What if a scammer pretends to be a bank ? It looks like it's very much possible to send an email as support@someBank.com. There must be some sort of protection against this?"

This is why we have standards such as Sender Policy Framewark (SPF). SomeBank.com can (should) publish an SPF record in its DNS to specify the SMTP servers that are authorized to send mail from senders at SomeBank.com. If a spoofer tries to send a message appearing to be from *@SomeBank.com, he is unlikely to be able to relay the message through one of SomeBank.com's SMTP servers. If he tries to send the message through a SMTP server other than one that is designated in the SPF record for SomeBank.com, the recipient’s spam filter would likely detect this mismatch and determine that there is a high likelihood that this message was spoofed.


So, how does Gmail provide its 'send email as:' feature, without breaking SPF?

See https://support.google.com/mail/answer/22370/send-emails-from-a-different-address-or-alias?hl=en, where it explains how to use this service. Note where it reads,

For school or work accounts, enter the SMTP server (for example, smtp.gmail.com or smtp.yourschool.edu) and the username and password on that account.

As you can see, Gmail relays the message through the SMTP server that is already designated for that domain. This avoids breaking SPF.

8
  • Thanks! Could you please explain in simpler terms your last 2 sentences ? I kind of have hard time understanding how exactly that works.
    – Noob
    Jun 3 at 22:59
  • 1
    "Gmail relays the message through the SMTP server that is already designated for that domain." - look at the video from the comment starting with 4:46. The user here is not using the mail server from the domain but is entering smtp.gmail.com and his credentials for this account. This is likely not the intended behavior how this should be used, but this way one can actually add arbitrary sender addresses. It is still up to the recipient to use SPF, DMARC etc - if these are set on the spoofed email at all. Jun 3 at 23:00
  • @SteffenUllrich Thank you! That is my point about arbitrary sender addresses. You could set up any address basically/
    – Noob
    Jun 3 at 23:02
  • 1
    OP, it only works if the domain does not have an SPF record setup, or has an SPF record that authorizes mail from this domain to be sent through smtp.gmail.com. if you tried doing this using sender address noob@paypal.com, it would fail, because paypal.com has an SPF record that says 'only accept incoming mail from *@paypal.com if it was sent from an SMTP server in [x,y,x]', (and smtp.gmail.com is not in [x,y,z]).
    – mti2935
    Jun 3 at 23:04
  • @mti2935 I didn't set up any SPF record, therefore, that's probably why it works. Thank you !
    – Noob
    Jun 3 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.