There is not really any connection between what is in the From/To/Cc headers of an email and where the email was actually sent from or to. For example, I just s

There is not really any connection between what is in the From/To/Cc headers of an email and where the email was actually sent from or to. For example, I just sent an email to my own GMail account and put "foo@example.com" in both the From and To headers. Here is a slighly obfuscated log of how I did it: mike@flan:~$ telnet gmail-smtp-in.l.google.com 25 Trying 2a00:1450:400c:c01::1a... Trying 74.125.71.26... Connected to gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP s83si999899wmf.10 - gsmtp EHLO whatever 250-mx.google.com at your service, [*.*.*.*] 250-SIZE 157286400 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8 MAIL FROM:<foo@example.com> 250 2.1.0 OK s83si999899wmf.10 - gsmtp RCPT TO:<*****@googlemail.com> 250 2.1.5 OK s83si999899wmf.10 - gsmtp DATA 354 Go ahead s83si999899wmf.10 - gsmtp From: <foo@example.com> To: <foo@example.com> Subject: Hello World Hello . 250 2.0.0 OK 1467538374 s83si999899wmf.10 - gsmtp QUIT 221 2.0.0 closing connection s83si999899wmf.10 - gsmtp Connection closed by foreign host. Google even accepted that email and delivered it. Even after Google forwarded it on to my non-Google email address, it still had "foo@example.com" in both the From and To headers. It does not have my GMail address in there at all. I'm surprised google accepted that email actually. Seeing as it outright hard-failed SPF checks. example.com makes a pretty clear statement in their SPF record that it should never ever be used to send email ("v=spf1 -all")