3 ms·
There's protections against this sort of thing that major isps implement. You can't just set your from address to whatever you want. Well you can, but it woul
by sbov 12y ago
There's protections against this sort of thing that major isps implement. You can't just set your from address to whatever you want. Well you can, but it would be likely be rejected, or at least wouldn't reach your target's inbox.
- MichaelGG 12y agoSPF allows you to fake the From header, so long your Return-Path is your own domain and passes checks. DMARC can pass if SPF passes. To end users, there's no discernible difference when there's another Return-Path domain. DKIM does allow you to force the From header to be signed, so hopefully that'll continue to pick up steam. It does break some things, like some mailing lists, and that probably contributes to why it's taken so long to get such things going. There's also a lot of "business critical" software out there that just assumes it can send as any user.