In general, SMTP isn't authenticated. RFC733[0], for example, the first network mail RFC (AFAIK), is dated 1977 when the Internet was a much more friendly and

In general, SMTP isn't authenticated. RFC733[0], for example, the first network mail RFC (AFAIK), is dated 1977 when the Internet was a much more friendly and trusting place. This lack of authentication is what allows for all the spam with forged From: headers. You can, for example, send an e-mail from the command-line using telnet[1] and have it appear to be from any e-mail address you wish. In the last several years there have been several attempts to address this such as DomainKeys[2], DKIM[3], SPF[4], and DMARC[5]. As for why Google allows the message through, well, you'd have to ask them. [0]: https://www.ietf.org/rfc/rfc733.txt https://www.ietf.org/rfc/rfc733.txt [1]: https://workaround.org/ispmail/lenny/test-mail-through-telnet https://workaround.org/ispmail/lenny/test-mail-through-telne... [2]: https://en.wikipedia.org/wiki/DomainKeys https://en.wikipedia.org/wiki/DomainKeys [3]: https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail [4]: https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework [5]: https://en.wikipedia.org/wiki/DMARC https://en.wikipedia.org/wiki/DMARC