Take the 2-minute tour ×

Recently someone asked me whether an email she received was spam. It seemed to be from a well-known bank (Belfius.be) in Belgium. It stated that some information was outdated and that it needed revision. Of course, the first thing that comes to mind is that it is spam. Why?

  • Loads of errors in language, bad sentences ...
  • The link that was provided was an evil link: it appeared as if it led to the website of belfius (something like belfius.be/revision1285). But when hovering over it, you could see that it actually referred to a completely other website. A .ca domain even.

Now, I immediately said Don't you click on that link but something made me wonder. The sender's email was noreply@belfius.be and belfius.be is the official website of the bank. So, how can this be? How can they fake their emailaddress?

share|improve this question
This kind of mails is generally known as phishing, which may be considered spam, although I think spam is more harmless and tries to sell you stuff, not gain access to your account(s). –  Roald van Doorn Nov 14 '12 at 14:08
I can throw a letter in the mail to you that says it's from Santa Claus. The only giveaway would be the California postmark. Same thing with email, more or less. –  David Schwartz Nov 14 '12 at 14:53
Both SMTP's MAIL FROM command and IMF's Mail header field can contain spoofed addresses. –  james.garriss Nov 14 '12 at 20:19
add comment

2 Answers

up vote 48 down vote accepted

Simple. By editing the From: header while sending the mail. This is known as "Email spoofing". The From: header is easily editable if you're sending the mail via PHP or something, no fancy tricks required. What is not editable, though is the IP address/domain name of the site from which it originated. If you check the plaintext email (in GMail, go to the menu next to the reply button, and "show original message"), the Received: headers carries all the information about its path (The deeper down the Received: header is, the further back in the email chain it is). Note that an email passing through multiple hops can have some of the deeper headers spoofed as well. You need to go downwards, seeing which headers (i.e. sites) you trust. Each header will say something like Received: from abc.com (IP address) by something.google.com (IP) (assuming you have GMail -- otherwise the by will be different). Now, this header was written by the by part. Start at the top, the first few Recieved: headers won't have a from/by. Find the first one with those. It's by will be belonging to your email provider--which you trust. See if you trust the from, and if you do, go on to the next Received: header (which you now trust), and so on. If you don't trust a header in between, all the ones below it cannot be trusted--those may have been spoofed.

Gmail generally detects spoofing, though, and puts a "abc@def.com via ghi@jkl.com" sort of hatnote on the email. Note that there are perfectly legitimate uses of email spoofing--many mailing lists spoof emails for a smoother experience. So do certain fora/message boards. Here, they send the email to make it look like it came from the original poster. The Reply-To: header is set to the list/webapp/whatever email id, so replying to it will by default go to the list(/etc). The list can then deal with it as it sees fit -- it can check for spam, maybe put on hold for moderation, etc. When it wants to send it, it will spoof your address and send it to everyone on the list (which is exactly what you wanted--to be able to have email-based discussions without using "Reply to All" and keeping a list of contacts to copy-paste).

What some "legitimate" spoofers do is that they set the Sender: header to their own id. This is supposed to mean "Sent by Sender on behalf of From". Note that the presence of a Sender: header doesn't mean anything when it comes to "illegitimate" spoofing -- that header is spoofable as well. Like I said, the only way to check is via the Recieved headers.

share|improve this answer
Thank you! And also thank you for that last legitimate use. Very informative! –  Bram Vanroy Nov 14 '12 at 11:56
How is the spoofing supposed to improve the experience. The only impact I've encountered from it is negative. Outlook effectively won't let me whitelist the messages (for automatic image download) because each one comes from a different mailist@randomnumber.maillistcompany.com address. –  Dan Neely Nov 14 '12 at 14:32
@DanNeely: Well, without spoofing, all emails would appear to come from list@domain.com. It gets confusing when you want to PM someone, and it's hard to keep track of who you're talking to. The spoofing makes it appear as if you're just having a conversation with a bunch of people, except that the mailing list is an intermediate entity (necessary for archiving and moderation). What do you mean each one comes from a different mailing list addy? That's probably just a particular list. –  Manishearth Nov 14 '12 at 14:37
@Manishearth I was thinking of despair.com's "Wailing List" (technically a marketing mail but I subscribe to it for the humor value). I'm at work so I can't copy what i get in outlook at home; but gmail shows it as ex The Wailing List wailinglist@despair.com via mail17.us2.mcsv.net both the mail# and us# subdomains vary from one message to the next. I several other subscriptions with similar issues from their 3rd party mailing services. –  Dan Neely Nov 14 '12 at 16:20
@DanNeely usually you'd use spoofing like Alice <alice@example.com> via list@example2.com –  OrangeDog Nov 14 '12 at 16:29
show 5 more comments

It's trivial to use a fake 'from' address. The beginners way is simply to edit the settings in your mail client and change default from address. Many service providers will send an email with a fake from field because the email server doesn't know what the real one is.

The spammers use dedicated custom software and always use fake from addresses.

share|improve this answer
add comment

Your Answer


