When I get an email from john@example.com, how certain can I be that it is actually from him?

If the SMTP "from" header is john@example.com it is possible that it could be spoofed. Can DKIM, SPF, or another mechanism make it more certain that the email was actually sent from that address?

  • 2
    This seems like a security question – Briz Jan 25 '12 at 19:15
  • You've combined two different things, SMTP's MAIL FROM command and IMF's From header field. Both, however, can be spoofed. A valid digital signature is your best hope. – james.garriss Nov 14 '12 at 20:16

Zero. It's trivially easy to spoof the from field to make it appear like the email came from someone else. DKIM is designed to provide authenticatation of mail servers, not individuals. The idea being that "valid" mail servers that normally send lots of emails (belonging to Google, Yahoo, etc) can be distinguished from spam mail servers.


It's trivial to spoof where an email came from.

There is really only one way to know with near 100% certainty that a given email really did come from a particular person: Ask them directly. I say near because they could always lie to you.

Other than that the only other real way to know is if that person has a personal certificate that the message has been signed and encrypted with and you have the key in order to read the message. However all that says is that someone with access to that signing key sent the email. Normally that's good enough.

For Police business it's usually good enough to establish the device an email came from and whether or not the person under investigation was reasonably the only person with access to that device during the time the email was sent. However, that can be pretty hard to do depending on how long ago it occurred, if the device is a home computer versus some type of mobile machine, the physical location the email was actually sent from, etc... Makes for a decent TV show though.



Summary: SMTP doesn't provide any authentication, so it is easy to impersonate and forge emails. Modifying SMTP extensively, or replacing it completely, is not believed to be practical.

Conclusion: Certainty will increase, hopefully, when a new protocol is implemented.

Reference: here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.