We are allocating emails to their online account. We discovered you can send a false email with a script by changing the "from" or "reply-to" in the email header. There must be a safe way to test the authenticity of this email - that is genuinely from the correct domain or email server that is allowed to send this email address?

Below is an example of a false email address that we managed to send to our online platform and by looking at the "from" managed to allocate it to that person's account. The example here fakes the user1@companydomain.com and managed to get through to the user's account by the PHP IMAP script using the from address to allocate the email to the user's account. Any suggestions how to safely/automated way to do this will be appreciated.

Delivered-To: upload@ouronlineplatform.com
Received: IP with SMTP id GHVKHOHBLL;
        Thu, 16 Oct 2014 12:11:16 -0700 (PDT)
X-Received: by IP with SMTP id p3mr4338460wjo;
        Thu, 16 Oct 2014 12:11:15 -0700 (PDT)
Return-Path: <daemon@mymacbook.local>
Received: from mymacbook.local (hostipxxxx.btcentralplus.com. [IP])
        by mx.google.com with ESMTP id xxxxxxxxx5
        for <upload@ouronlineplatform.com>;
        Thu, 16 Oct 2014 12:11:15 -0700 (PDT)
Received-SPF: none (google.com: mymacbook.local does not designate permitted sender hosts) client-ip=IP;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: daemon@mymacbook.local does not designate permitted sender hosts) smtp.mail=daemon@mymacbook.local
Received: by mymacbook.local (Postfix, from userid 1)
    id E6F761687C71; Thu, 16 Oct 2014 20:11:14 +0100 (BST)
To: upload@ouronlineplatform.com
Subject: testing
X-PHP-Originating-Script: 501:email_spoofing2.php
From: user1@companydomain.com
Reply-To: user1@companydomain.com
X-Mailer: PHP/5.4.31
Message-Id: <20141016191114.E6F761687C71@mymacbook.local>
Date: Thu, 16 Oct 2014 20:11:14 +0100 (BST)


There is no direct way to know if the from address is forged or not. It is trivially easy to change when sending an email.

You can't even always tell if it came from the right server - many domains dont have SPF setup properly. And sometimes people send emails through other servers because they have to - for example some ISPs require you to send through their mail server and block others.

There are several ways to handle this:

  • Send an email back requiring confirmation by clicking a link. They can forge the from address, but they wont be able to recieve replies.

  • Require the emails to be signed with a PGP key or similar encryption.

  • Attach the file to their account as a "draft" or "pending item" or something and have them approve them later.

  • Give everyone a unique secret email address to send to. This is how services like Evernote handle sending in email attachments. Its not perfect but it does help. You can still validate the from address or simply allow it from any address. Make sure people can change their secret address in case it gets out.

  • Requiring the email to be PGP signed is not an easy requeriment to met. Very few users will be able to do this. Requiring the account to be manually approved will not solve the problem, because even the human will not be able to tell if the headers has been changed or not. But the secret mail and the mail with a link will easily solve the problem. – ThoriumBR Dec 26 '14 at 12:12
  • @Thoriumbr i meant approved by the person sending in the email - surely they will know what they did or did not send. Agreed that pgp propably wont work unless the userbase is very technically inclined. – Grant Dec 26 '14 at 15:56

There is no way to ensure authenticity of standard SMTP mail. The system is simply not designed to require or enforce authenticity. You will need to do something at the content layer, such as S/MIME or PGP/GPG, if you require assurance that the email is from a legitimate source.

  • 2
    You can ensure it's from a valid server for that domain (through SPF and the like), though. – cpast Dec 26 '14 at 0:16

Welcome to RFC2821.

You can combine, though this is a truly monumental task if you do it by yourself, but great as a kind of learning moment, different feature points to obtain a score on whether the mail is spam or ham. You could, grade the contents of the mail based on the words whether it is spam or ham ( word clustering on a pre supervised labelled data + no smime/pgp encrypted stuff ). Grade the 2822 headers with similar methodology. There's spam assassin that can do this, and help with the grading of the mail to determine spam ... or ham.

Just in case you're wondering, remember foxbat mailers are only used by chinese users. So you can be assured if the receptionist gets one of these, it's spam.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.