4 ms·
Well, I was all set to explain that SPF only checks the envelope sender, not the from: address header that is displayed to the user. Then I decided to test it,
by thaumaturgy 13y ago
Well, I was all set to explain that SPF only checks the envelope sender, not the from: address header that is displayed to the user.
Then I decided to test it, and in fact Gmail does seem to be doing more than that. I ran a two-line script as root from my mail server to send a message with an envelope-sender from my domain (which has a basic SPF txt record in its DNS) and a from: header from LinkedIn, and Gmail spit it back at my return address a moment later saying that it smelled like spam. So, good for Gmail!
But, I don't think this is common behavior, and the article doesn't actually say that the target has a Gmail account.
- krick 13y ago> But, I don't think this is common behavior It pretty much is. The actual settings vary between different mail providers and this is actually more complicated than checking header against sender IP. So everything is possible, but that mail-sending part needs more explanation anyway.
- jwcrux 13y agoSure - SPF may very well only check the envelope sender, but isn't that usually plenty? If you can't spoof the Linkedin envelope sender, and the mail goes to SPAM, who cares if the From: address is spoofed? The user likely won't see it anyway.
- thaumaturgy 13y agoAnybody that can run sendmail as root (or use an alternate program, or compile their own) can spoof the envelope sender.
- jwcrux 13y agoAh, gotcha. You're saying that you sent an email with a valid envelope sender from your domain, with only a spoofed From: address, and gmail sent it back. If so, nice!
- thaumaturgy 13y agoYep, exactly.
- iambateman 13y agoIf it's a corporate email account (as is mentioned), Microsoft is a much likelier candidate.