0

Can someone spoof its IP address to mine when sending emails? I know we can see the IP address of the sender in the email header. If someone had my IP, can he/she use it to show in email headers? Even with handshake protocols?

I want to know if its possible to someone send emails while pretending to be me.

Improve this question

1 Answer 1

Reset to default
1

You likely refer to the Received field in the mail header, i.e. something like this:

Received: from e239-39.smtp-out.eu-west-1.amazonses.com ([23.251.239.39]) by
     mx-ha.gmx.net (mxgmx016 [212.227.15.9]) with ESMTPS 
     ...

Each mail server on the path of the mail adds such a Received field on top of the mail header. The IP address in this line is determined by the mail server from the TCP connection. It can not be faked by the sender, since IP spoofing in a multi-exchange TCP connection (as used in mail delivery) is not possible.

But, it is possible that the attacker simply adds their own Received fields into the mail before it gets delivered, which can contain any content defined by the attacker, including your IP address. These additional Received fields are usually simply passed through to the recipient. Since it is common that a mail contains multiple Received fields this can be used to confuse the target since it can be unclear which of these Received fields are actually added by a real mail server and which are faked.

Improve this answer
9
  • And can they modify the headers to make it look like the email was sent by my IP address?
    – Mateus Alberghini
    Jan 4 at 12:52
  • @MateusAlberghini: to cite myself: "But, it is possible that the attacker simply adds their own Received fields into the mail before it gets delivered, which can contain any content defined by the attacker, including your IP address."
    – Steffen Ullrich
    Jan 4 at 12:59
  • Interesting. And is there a way to see if this happened? Are there any other fields used to identify the sender?
    – Mateus Alberghini
    Jan 4 at 14:24
  • And the first IP address logged in the header corresponds to the first server this email reached or to the machine IP where the email client is running?
    – Mateus Alberghini
    Jan 4 at 14:27
  • 1
    @MateusAlberghini: Each MTA adds its own Received field on top of the others. But it is impossible to determine if any existing Received fields are added by previous MTA (i.e. real) or by the client itself (i.e. fake).
    – Steffen Ullrich
    Jan 4 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .