How reliable is the "from" header in an email?

When I get an email from john@example.com, how certain can I be that it is actually from him?

If the SMTP "from" header is john@example.com it is possible that it could be spoofed. Can DKIM, SPF, or another mechanism make it more certain that the email was actually sent from that address?

Lance Fisher

Posted 2012-01-25T19:14:52.650

Reputation: 503

2This seems like a security question – None – 2012-01-25T19:15:36.330

You've combined two different things, SMTP's MAIL FROM command and IMF's From header field. Both, however, can be spoofed. A valid digital signature is your best hope. – james.garriss – 2012-11-14T20:16:37.057

Answers

Zero. It's trivially easy to spoof the from field to make it appear like the email came from someone else. DKIM is designed to provide authenticatation of mail servers, not individuals. The idea being that "valid" mail servers that normally send lots of emails (belonging to Google, Yahoo, etc) can be distinguished from spam mail servers.

adelphus

Posted 2012-01-25T19:14:52.650

Reputation: 230

It's trivial to spoof where an email came from.

There is really only one way to know with near 100% certainty that a given email really did come from a particular person: Ask them directly. I say near because they could always lie to you.

Other than that the only other real way to know is if that person has a personal certificate that the message has been signed and encrypted with and you have the key in order to read the message. However all that says is that someone with access to that signing key sent the email. Normally that's good enough.

For Police business it's usually good enough to establish the device an email came from and whether or not the person under investigation was reasonably the only person with access to that device during the time the email was sent. However, that can be pretty hard to do depending on how long ago it occurred, if the device is a home computer versus some type of mobile machine, the physical location the email was actually sent from, etc... Makes for a decent TV show though.

NotMe

Posted 2012-01-25T19:14:52.650

Reputation: 396

None.

Summary: SMTP doesn't provide any authentication, so it is easy to impersonate and forge emails. Modifying SMTP extensively, or replacing it completely, is not believed to be practical.

Conclusion: Certainty will increase, hopefully, when a new protocol is implemented.

Reference: here

Peter Arandorenko

Posted 2012-01-25T19:14:52.650

Reputation: 41