Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I read that you can connect to an SMTP server (like gmail, hotmail, etc) via telnet, and manually put in commands to send anonymous email (or even worse, send email with a false "from" address). Is this still possible? (I'm receiving many emails from dubious addresses.)

share|improve this question
up vote 7 down vote accepted

As Wes said, it's possible, depends of the server's level of security. Below is a classic telnet sequence against a SMTP server :

$ telnet 25
Connected to
Escape character is '^]'.
220 ESMTP Postfix
EHLO dummydummy
250-SIZE 10240000
250 DSN
250 2.1.0 Ok
250 2.1.5 Ok
354 End data with <CR><LF>.<CR><LF>
250 2.0.0 Ok: queued as 8ACF13E1B8
share|improve this answer
The recipient (the address following FROM: or TO:) must be a valid "reverse-path", between < > and without separating whitespace. (See RFC 5321 § 3.3 and § 4.1.2.) Other forms are only accepted by software for backwards compatibility reasons. – grawity May 26 '11 at 15:17
One can do pretty much anything with manual smtp, but the problem is that it can be hard to craft a mail that doesn't get detected as spam or that doesn't get rejected. It is also very probable that the server will add your IP in the mail headers. So you would have to do as if you received it from some other server, but such things don't resist any serious analysis. However it's worth noting that, from the SMTP point of view, you can have any adress in the FROM field. – Yves Sep 17 '14 at 14:28

Though historically possible, and permitted by email-related specifications, many modern anti-spam measures will thwart or curtail attempts to do this.

Many SMTP servers check DNS Block Lists before accepting mail and home user IP ranges are often blocked as a matter of policy. Modern SMTP servers frequently also scrutinize the "from" address, checking that the domain is valid, and that the IP address of the sending machine is authorized by that domain to send emails (SPF). Techniques such as greylisting do not outright prevent manually sending mail, but they make the process more onerous by forcing the user to send the same message more than once with a delay in between. Even if the email is accepted by the SMTP server, anti-spam software that analyzes message content will often flag messages with apparently bogus sender information, or that doesn't appear to be sent by normal mail software.

In summary, it's still possible, but it's not easy. The from addresses in your spam are almost certainly fake, but the fakery was probably done with spam-specific software--not manually.

share|improve this answer

Yes, it is still possible. It's fairly easy to deliver mail from a completely bogus sender because SMTP doesn't try to ensure the sender is an actual account or a valid email address, for example. Hence the start of the spam era...

The only thing that has made it harder lately is that you can't connect to just "anywhere" to deliver mail to "anywhere else". IE, you can't connect to microsoft's server and try to send mail to an address. Microsoft should now only accept mail for a microsoft recipient. But it'll still accept it from even if it doesn't exist.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .