3 ms·
At Microsoft, when an email has an internal sender address it will not get delivered unless that email did in fact come from an internal Exchange server. In 19
by DenisM 11y ago
At Microsoft, when an email has an internal sender address it will not get delivered unless that email did in fact come from an internal Exchange server.
In 1998 I was able to use SMTP to send an email "from Bill Gates" (only sent it to myself for my own personal amusement), but the trick stopped working later.
- bostonpete 11y agoThat doesn't seem like it would guard against an e-mail sent from "a very similar email domain" like ndespres described.
- DenisM 11y agoYes, but I could always double-click on the mail address in Outlook and see the internal address book entry if the email is spelt correctly. When verification is easy, people do more of it.
- Shog9 11y agoWhich brings it back to being a process issue: if folks are diligent about verifying (whether that's a phone call or clicking on a name), then this is harder to pull off.
- dexwiz 11y agoThere are a lot sent along with an email besides the To/From names. The name is pretty easy to spoof, but the SMTP request and timestamps is much harder. Also most reputable senders now use SPF, a type of DNS record, to verify email servers. But email usually trusts by default, unless your servers are very locked down. You can still send 'unverified' email, but its easier to trip spam filters if you send too much.
- protomyth 11y agoI ran into something like that when demonstrating our report delivery at a company. I remember saying "Now notice I change the header to say it comes from [person in room] which of course the e-mail server will reject... oh, my... well, I guess it doesn't...". I was 'encouraged' to have a talk with the e-mail team.
- thrownaway2424 11y agoDMARC makes this pretty trivial these days. A mail shouldn't be accepted by _any_ system unless it is authentic.
- siberianbear 11y agoIn 1993, I had a summer internship at Apple. After I returned to the university that fall, I sent a fake email from Andy Grove (the CEO of Intel at the time) to my new friend at Apple. I did this just by opening a telnet session to the SMTP port at apple.com and manually typing in SMTP commands and associated text. Apple's SMTP server happily delivered a fake email from agrove@intel.com from a system at ucdavis.edu. Lol, those were the days....