0

Can someone spoof its IP address to mine when sending emails? I know we can see the IP address of the sender in the email header. If someone had my IP, can he/she use it to show in email headers? Even with handshake protocols?

I want to know if its possible to someone send emails while pretending to be me.

1 Answer 1

1

You likely refer to the Received field in the mail header, i.e. something like this:

Received: from e239-39.smtp-out.eu-west-1.amazonses.com ([23.251.239.39]) by
     mx-ha.gmx.net (mxgmx016 [212.227.15.9]) with ESMTPS 
     ...

Each mail server on the path of the mail adds such a Received field on top of the mail header. The IP address in this line is determined by the mail server from the TCP connection. It can not be faked by the sender, since IP spoofing in a multi-exchange TCP connection (as used in mail delivery) is not possible.

But, it is possible that the attacker simply adds their own Received fields into the mail before it gets delivered, which can contain any content defined by the attacker, including your IP address. These additional Received fields are usually simply passed through to the recipient. Since it is common that a mail contains multiple Received fields this can be used to confuse the target since it can be unclear which of these Received fields are actually added by a real mail server and which are faked.

9
  • And can they modify the headers to make it look like the email was sent by my IP address? Jan 4, 2023 at 12:52
  • @MateusAlberghini: to cite myself: "But, it is possible that the attacker simply adds their own Received fields into the mail before it gets delivered, which can contain any content defined by the attacker, including your IP address." Jan 4, 2023 at 12:59
  • Interesting. And is there a way to see if this happened? Are there any other fields used to identify the sender? Jan 4, 2023 at 14:24
  • And the first IP address logged in the header corresponds to the first server this email reached or to the machine IP where the email client is running? Jan 4, 2023 at 14:27
  • 1
    @MateusAlberghini: Each MTA adds its own Received field on top of the others. But it is impossible to determine if any existing Received fields are added by previous MTA (i.e. real) or by the client itself (i.e. fake). Jan 4, 2023 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .