Manual SMTP with anonymous sender

Question

I read that you can connect to an SMTP server (like gmail, hotmail, etc) via telnet, and manually put in commands to send anonymous email (or even worse, send email with a false "from" address). Is this still possible? (I'm receiving many emails from dubious addresses.)

Answer 1

As Wes said, it's possible, depends of the server's level of security. Below is a classic telnet sequence against a SMTP server :

$ telnet 127.0.0.1 25
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 hostname.server.net ESMTP Postfix
EHLO dummydummy
250-hostname.server.net
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM:<fake@email.net>
250 2.1.0 Ok
RCPT TO:<recipient@email.net>
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
test
.
250 2.0.0 Ok: queued as 8ACF13E1B8
QUIT

Answer 2

Yes, it is still possible. It's fairly easy to deliver mail from a completely bogus sender because SMTP doesn't try to ensure the sender is an actual account or a valid email address, for example. Hence the start of the spam era...

The only thing that has made it harder lately is that you can't connect to just "anywhere" to deliver mail to "anywhere else". IE, you can't connect to microsoft's server and try to send mail to an @apple.com address. Microsoft should now only accept mail for a microsoft recipient. But it'll still accept it from anyone@anywhere.com even if it doesn't exist.

Answer 3

Though historically possible, and permitted by email-related specifications, many modern anti-spam measures will thwart or curtail attempts to do this.

Many SMTP servers check DNS Block Lists before accepting mail and home user IP ranges are often blocked as a matter of policy. Modern SMTP servers frequently also scrutinize the "from" address, checking that the domain is valid, and that the IP address of the sending machine is authorized by that domain to send emails (SPF). Techniques such as greylisting do not outright prevent manually sending mail, but they make the process more onerous by forcing the user to send the same message more than once with a delay in between. Even if the email is accepted by the SMTP server, anti-spam software that analyzes message content will often flag messages with apparently bogus sender information, or that doesn't appear to be sent by normal mail software.

In summary, it's still possible, but it's not easy. The from addresses in your spam are almost certainly fake, but the fakery was probably done with spam-specific software--not manually.