1

When I get an email from [email protected], how certain can I be that it is actually from him?

If the SMTP "from" header is [email protected] it is possible that it could be spoofed. Can DKIM, SPF, or another mechanism make it more certain that the email was actually sent from that address?

Improve this question
2
  • 2
    This seems like a security question
    – Briz
    Commented Jan 25, 2012 at 19:15
  • You've combined two different things, SMTP's MAIL FROM command and IMF's From header field. Both, however, can be spoofed. A valid digital signature is your best hope.
    – james.garriss
    Commented Nov 14, 2012 at 20:16

3 Answers 3

Reset to default
5

Zero. It's trivially easy to spoof the from field to make it appear like the email came from someone else. DKIM is designed to provide authenticatation of mail servers, not individuals. The idea being that "valid" mail servers that normally send lots of emails (belonging to Google, Yahoo, etc) can be distinguished from spam mail servers.

Improve this answer
2

It's trivial to spoof where an email came from.

There is really only one way to know with near 100% certainty that a given email really did come from a particular person: Ask them directly. I say near because they could always lie to you.

Other than that the only other real way to know is if that person has a personal certificate that the message has been signed and encrypted with and you have the key in order to read the message. However all that says is that someone with access to that signing key sent the email. Normally that's good enough.

For Police business it's usually good enough to establish the device an email came from and whether or not the person under investigation was reasonably the only person with access to that device during the time the email was sent. However, that can be pretty hard to do depending on how long ago it occurred, if the device is a home computer versus some type of mobile machine, the physical location the email was actually sent from, etc... Makes for a decent TV show though.

Improve this answer
1

None.

Summary: SMTP doesn't provide any authentication, so it is easy to impersonate and forge emails. Modifying SMTP extensively, or replacing it completely, is not believed to be practical.

Conclusion: Certainty will increase, hopefully, when a new protocol is implemented.

Reference: here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .