Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in the way. The following are the ways I currently know of:

Telnet to a mail server and enter the from address and then the rcpt address, but I normally see "550 unable to relay."

Use Outlook with the "Send As" permission.

Create a Windows Live Mail/Outlook Express account with any [email protected]

The bottom line is this is for testing/educational purposes and I would like to know if it's possible to send an email that doesn't get caught up in the spam filter with a spoofed "From" field with a link/logo in the body. I understand this could fall into a "hacking" category, but the same holds true for anyone performing social engineering exercises with signed documentation.

Note: So far the telnet method seems to be the best route, except for some hangups such as the 550 error.

2 Answers 2


Let's suppose that someone (Mario) wants to send an email to someone else (let's call him Nicolas). Nicolas' mailbox is filled by a unique server, let's say smtp.gouv.fr (that's a fictitious example). So, whatever Mario does, the email will have to go through that server, transmitted with the SMTP protocol (the one with the 'RCPT' command). Mario would like the From line to be: From: [email protected]. Note that there are actually two "from" addresses: the one in the From: header (which the recipient sees with his usual mail-reading application), and the one which is given through the MAIL FROM SMTP command (the latter will appear in the Return-Path: header).

Now, although the email has to go through Nicolas' SMTP server, it may make a few hops. The normal mail-sending situation is that the sender uses the SMTP server of his ISP, and that server will talk to the destination SMTP server. Mario's ISP server is smtp.governo.it. Mario can decide to do his telnet (or equivalent, but it always SMTP at the end) either to smtp.governo.it, smtp.gouv.fr, or some other server, e.g. smtp.bundestag.de (the SMTP server of Angela's ISP), or some other server (smtp.buckingham.uk).

There are various things which can prevent Mario from doing so:

  • Mario's ISP may prevent any outgoing connection from his machine to any SMTP server (i.e. any TCP connection which targets port 25) except if the target machine is smtp.governo.it. Many ISP do that, mainly to prevent zombie machine from spamming widely without any control.

  • smtp.governo.it may reject the attempt because the advertised "from" address is not an address ending with "@governo.it". The server may enforce such a filter on the "From:" header, or on the MAIL FROM command, or on both. Some (not all) ISP apply such rules.

  • If Mario contacts smtp.buckingham.uk, that server may reject the attempt because the mail is neither destined to an address in buckingham.uk, or sent with a "from" address in "@buckingham.uk". Servers which forward arbitrary emails from and to the outside are called "open relays" and are generally frowned upon, namely because spammers just love them.

  • If Mario contacts smtp.bundestag.de, that server may also reject the attempt, although the mail is indeed advertised as being sent by Angela, because smtp.bundestag.de knows that Angela would use a connection coming from one of the IP addresses which are indeed part of the network managed by bundestag.de. If smtp.bundestag.de was not doing that, it would also be deemed an "open relay" (although less open than the previous instance, but partly open nonetheless).

  • If Mario finds a SMTP server (not smtp.bundestag.de) which accepts to forward the email, or if Mario connects directly to smtp.gouv.fr, then the attempt may still get rejected if the bundestag.de domain uses SPF. SPF is a way for a domain to advertise, through the DNS, some mail-sending policies. Here, bundestag.de would publish with SPF the information that normal emails sent from @bundestag.de people should originate from smtp.bundestag.de and nowhere else. smtp.gouv.fr, upon seeing Mario's connection (or the connection from the gullible SMTP server that Mario found), may then look at the SPF records for bundestag.de, and detect the anomaly. Of course, SPF is not used everywhere, and since it is DNS based it is vulnerable to coordinated DNS attacks ("DNS poisoning" and things like that).

  • Some big mail providers enforce arbitrary obscure limitations, which may have the same effect than SPF, but in an undocumented and sometimes officially denied way.

So the best bet for Mario would be to either connect with telnet to smtp.gouv.fr (assuming that his ISP lets him do that, and that bundestag.de does not use SPF, or that smtp.gouv.fr disregards SPF information); or he could try to find some hackable or otherwise complacent machine somewhere in the bundestag.de, and use it as an open relay to send the mail through smtp.bundestag.de (which would have the added bonus of making all the headers "realistic", as if Angela had done it herself).

  • 1
    It's worth mentioning that there are a number of services out there which automate this process. Fogmo being one of them.
    – Jonathan
    Commented Oct 10, 2012 at 18:08

Many mail servers only validate your login and their domain, but not the e-mail address.

So if you want to spoof a@mailserver you may be able to log in as b@mailserver and send an e-mail "from" a@mailserver. The server validates the login and that the sender belongs to his domain and sends a mail, which is indistinguishable.

Many providers do things to prevent this. Some add the login as a mail header or at least some unique id (i.e. GMail) for the user. Others just filter on the full from address of the sender, if he is allowed to use it. Many others are just open to this kind of attack.

This only works, of course, if you can get your own account at the corresponding server.

  • Beware, you don't login with an E-mail. This is a too common confusion between account and E-mail which was promoted by bad web servers admin and is causing a lot of cyber-crime. Identical account on different web servers is a consequence of this dangerous confusion: use of an E-mail as an account.
    – dan
    Commented Jul 30, 2021 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .