NICEVILLE, Fla. — In this week’s edition of It’s Geek To Me, Jeff Werner explains why spam emails can appear to come from your own email address and how the email system allows senders to manipulate the information displayed in the From field.
Niceville.com Community Partner
QUESTION:
William R from Fort Walton Beach asks:
How do mass e-mailers send me an email containing my exact email address in the FROM field?
ANSWER:
Jeff Werner responds:
The answer to your question isn’t really as technical as it might seem at first, William.
First of all, in order for the spammer to send you mail at all, they must have possession of your address. One big question that you didn’t ask is how they got it in the first place. That topic is way too big to be handled here, so I’ll stick to answering your question instead.
It’s a relatively small matter to manipulate the email system to do what one wants. Email relies on a standard protocol named Simple Main Transfer Protocol, or SMTP. Back decades ago, when SMTP was designed, the internet was a relatively small, friendly neighborhood of academics and researchers who trusted one another. The creators of SMTP didn’t feel the necessity to build-in security measures like identity verification.
SMTP treats digital mail the exact same way you or I would treat a traditional paper letter. That is, when you get ready to drop an envelope into a mailbox, you can write absolutely any name and address that you want in the return address corner. The post office doesn’t make any attempt to verify that “From” information – they just read the “To” address and deliver the letter. SMTP, and all the mail servers that implement the protocol, do the same thing with email.
Niceville.com Community Partner
Readers, what William didn’t mention in the public portion of his submission is that he included a screenshot showing an example of one of the offending addresses. Of course, I’ve redacted his personal information from the column, so don’t get any big ideas of trying to use this information for any illicit purposes. The address in William’s “From” box read like this:
“WilliamR@MyMail.com’s BREAKING NEWS ALERT”
<info@conservativeinamerica.com>
Take note of the two parts of data present. The first part is what your email client displays to you as the name of the sender. Let me repeat, a sender can put anything here.
I’ve personally sent joke emails to people as “God@heaven.com”, “Santa@NorthPole.org” and other well-knowns, such as musicians and celebrities. It’s a relatively small matter for someone to take the address from the “To” box and stick it in the “From” line. In this case, they appended some other attention-grabbing text that pushes an agenda.
The second part of William’s “From” information, the part contained in the carets <> is, in this case, probably the actual email address from which the email originated. I say “probably” because even this can be spoofed by someone skilled enough in email manipulation.
For a typical home email user, setting up a spoof like this can be a bit difficult, but for someone running an email mill it’s a simple mail merge operation. They have a template, a database-full of email addresses, and some cleverly written software to do all the heavy lifting.
Niceville.com Community Partner
There are lots of other “secrets” to email that are only secret to people unfamiliar with SMTP and email servers. One that comes to mind immediately is the “Reply-To” field, which controls what address is put in the “To” box when you hit “Reply” in your email client. Yup – the sender can route replies to emails that they send to a completely different mailbox, including one that is neither the “To” nor the “From” address.
It’s a relatively easy matter to peek behind the scenes and examine a message’s email header. Just open the message in your email client (like Gmail, or Outlook) and look for an option like “View Raw Message” or “Show Original” or “View Message Details”.
You’ll get a whole bunch of technical text that probably won’t mean anything to you. Examine it carefully, and buried inside you’ll find familiar fields like To, From, Reply-To, and many more. Viewed in this manner, the data is not obfuscated in any way, so you can be sure you’re seeing all the information that the sender used to encode the message.
To view additional content, comment on articles, or submit a question, visit my website at ItsGeekToMe.co.
Jeff Werner, a software engineer based in Niceville, Florida, has been writing his popular “It’s Geek to Me” tech column since 2007. He shares his expertise to help readers solve everyday tech challenges.
Niceville.com Community Partner
