Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How can I manipulate the "from" field in an email and make the "to" user see something different then the actual.

Example:

really from

From: TStamper@yahoo.com

but they see

From: Tremayne "Top Dog" Stamper

I've heard its from manipulating SMTP, but really not sure how accurate that is or how it can be done

share|improve this question
1  
I see this in as a valid issue. We do this all the time (particularly make an e-mail from a piece of software look like it's sending for a user). –  C. Ross May 7 '09 at 15:08
    
I agree that it can be a valid issue if you want to change the From field to display something like a real name instead of an address. We do that all the time in our systems also. It's just a little bit of a flag because of the example in the question, changing from one address to another. Spam bait. –  squillman May 7 '09 at 15:11
    
updated with better example –  TStamper May 7 '09 at 15:13
    
Thats why they created SPF records –  Elijah Glover Jun 1 '09 at 2:21

6 Answers 6

up vote 12 down vote accepted

At it's base, SMTP is just a text based protocol with no real verification. Here's an example:

=== Trying g3.example.net:25...
=== Connected to g3.example.net.
<-  220 home.example.net ESMTP Exim 4.68 Thu, 07 May 2009 11:03:21 -0400
 -> EHLO g3.example.net
<-  250-home.example.net Hello g3.example.net [192.168.0.4]
<-  250-SIZE 52428800
<-  250-PIPELINING
<-  250-AUTH CRAM-SHA1 CRAM-MD5 MSN
<-  250-STARTTLS
<-  250 HELP
 -> MAIL FROM:<jj33@g3.example.net>
<-  250 OK
 -> RCPT TO:<jj33@g3.example.net>
<-  250 Accepted
 -> DATA
<-  354 Enter message, ending with "." on a line by itself
 -> Date: Thu, 07 May 2009 11:03:21 -0400
 -> To: jj33@g3.example.net
 -> From: jj33@g3.example.net
 -> Subject: test Thu, 07 May 2009 11:03:21 -0400
 -> X-Mailer: swaks v20070921.0-dev jetmore.org/john/code/#swaks
 -> 
 -> This is a test mailing
 -> 
 -> .
<-  250 OK id=KJA4HL-0006M6-8T
 -> QUIT
<-  221 home.example.net closing connection
=== Connection closed with remote host.

The "MAIL FROM:" line defines the SMTP envelope sender, and the From: is defined in the message DATA. There are wasy to protect against this, but they are defined in the mail server logic, not in the protocol itself.

For instance, I, as a mail provide, may require a user to authenticate using a user@domain type username. Then my mail server might require that any mail they send have an envelope-sender and a From: header that match the user I authenticated as. Additional technologies like DKIM and SPF can help in this area also.

share|improve this answer

There are a couple of different things to consider here. If you just want to display a different name or e-mail address, set the "From" header of the message (the message from address) to the e-mail address with the display name in brackets as such:

From: <Joe Example> joe@example.com

Remember that the "from" line in the message header is only used for display purposes. The actual routing is done by the SMTP envelope address. This is what the SMTP servers actually use to transmit the message between servers. This can be different from the message "from" header. If you have a custom SMTP engine, just have it use one address in the SMTP envelope and a different one in the "from" header on the actual message.

There are a number of legitimate reasons that you might want to do this, but please refrain from nefarious purposes.

share|improve this answer
1  
The bracket example is wrong, it's backwards –  jj33 May 7 '09 at 15:29
    
Fixed; it's been a while since I've implemented this kind of thing. –  Justin Scott May 7 '09 at 15:52
telnet some_smtp_server.com 25
ehlo whatsup
mail from: JohnBaker@yahoo.com
rcpt to: recipient@somewhere.com
data
your message here
end with a dot on a single line like this:
.

Of course you'll need an SMTP server that allows relaying, which is almost impossible to find... or roll your own (just don't use this knowledge to spam!).

share|improve this answer

Yes, it's by manually setting SMTP headers and is trivial to accomplish. Google it. But don't get caught spamming......

share|improve this answer

The "really from" address comes from the "from:" dialog in the SMTP conversation.

The "fake from" comes from exploiting the common practice in email clients of displaying the various header fields as laid out in the Data portion of the SMTP conversation. For instance:

# telnet mail.example.com 25
Connected to mail.example.com.
Escape character is '^]'.
220 mail.example.com ESMTP Postfix
helo fakeserver
250 mail.example.com
mail from: real@example.com
250 2.1.0 OK
rcpt to: real@example.com
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
from: fake@example.com
to: you@example.com
subject: This is a subject
This is the body.
.
250 2.0.0 Ok: queued as 90D0F95A06
quit
221 2.0.0 Bye
Connection closed by foreign host.
#

If you had left out the "from:" and "to:" lines in the Data portion, it would have displayed the actual envelope sender and recipient.

Note that these sorts of tricks are often looked for by spam filters, and will certainly not make you any permanent friends. Also, this doesn't work on all mail clients (just the most common ones).

share|improve this answer

This my 2c straight out of the code - written in C#

    public static void SendSpam(string message, string to)
    {
        System.Net.Mail.MailMessage myMessage = new System.Net.Mail.MailMessage("Fake Name", to);
        myMessage.Subject = "SPAM";
        myMessage.Body = message;
        System.Net.Mail.SmtpClient client = new System.Net.Mail.SmtpClient("mail.mailserver.com", 25);
        System.Net.NetworkCredential c = new System.Net.NetworkCredential("realusername@mailserver.com", "realpassword");
        client.Credentials = c;
        client.Send(myMessage);
    }
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.