Fake "FROM" email to allocate to account

Question

We are allocating emails to their online account. We discovered you can send a false email with a script by changing the "from" or "reply-to" in the email header. There must be a safe way to test the authenticity of this email - that is genuinely from the correct domain or email server that is allowed to send this email address?

Below is an example of a false email address that we managed to send to our online platform and by looking at the "from" managed to allocate it to that person's account. The example here fakes the [email protected] and managed to get through to the user's account by the PHP IMAP script using the from address to allocate the email to the user's account. Any suggestions how to safely/automated way to do this will be appreciated.

Delivered-To: [email protected]
Received: IP with SMTP id GHVKHOHBLL;
        Thu, 16 Oct 2014 12:11:16 -0700 (PDT)
X-Received: by IP with SMTP id p3mr4338460wjo;
        Thu, 16 Oct 2014 12:11:15 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mymacbook.local (hostipxxxx.btcentralplus.com. [IP])
        by mx.google.com with ESMTP id xxxxxxxxx5
        for <[email protected]>;
        Thu, 16 Oct 2014 12:11:15 -0700 (PDT)
Received-SPF: none (google.com: mymacbook.local does not designate permitted sender hosts) client-ip=IP;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: [email protected] does not designate permitted sender hosts) [email protected]
Received: by mymacbook.local (Postfix, from userid 1)
    id E6F761687C71; Thu, 16 Oct 2014 20:11:14 +0100 (BST)
To: [email protected]
Subject: testing
X-PHP-Originating-Script: 501:email_spoofing2.php
From: [email protected]
Reply-To: [email protected]
X-Mailer: PHP/5.4.31
Message-Id: <[email protected]>
Date: Thu, 16 Oct 2014 20:11:14 +0100 (BST)

hello

Answer 1

There is no direct way to know if the from address is forged or not. It is trivially easy to change when sending an email.

You can't even always tell if it came from the right server - many domains dont have SPF setup properly. And sometimes people send emails through other servers because they have to - for example some ISPs require you to send through their mail server and block others.

There are several ways to handle this:

• Send an email back requiring confirmation by clicking a link. They can forge the from address, but they wont be able to recieve replies.

• Require the emails to be signed with a PGP key or similar encryption.

• Attach the file to their account as a "draft" or "pending item" or something and have them approve them later.

• Give everyone a unique secret email address to send to. This is how services like Evernote handle sending in email attachments. Its not perfect but it does help. You can still validate the from address or simply allow it from any address. Make sure people can change their secret address in case it gets out.

Answer 2

There is no way to ensure authenticity of standard SMTP mail. The system is simply not designed to require or enforce authenticity. You will need to do something at the content layer, such as S/MIME or PGP/GPG, if you require assurance that the email is from a legitimate source.

Answer 3

Welcome to RFC2821.

You can combine, though this is a truly monumental task if you do it by yourself, but great as a kind of learning moment, different feature points to obtain a score on whether the mail is spam or ham. You could, grade the contents of the mail based on the words whether it is spam or ham ( word clustering on a pre supervised labelled data + no smime/pgp encrypted stuff ). Grade the 2822 headers with similar methodology. There's spam assassin that can do this, and help with the grading of the mail to determine spam ... or ham.

Just in case you're wondering, remember foxbat mailers are only used by chinese users. So you can be assured if the receptionist gets one of these, it's spam.