{var%20f='http://v.t.sina.com.cn/share/share.php?appkey=1515056452',u=z||d.location,p=['&url=',e(u),'&title=',e(t||d.title),'&source=',e(r),'&sourceUrl=',e(l),'&content=',c||'gb2312','&pic=',e(p||'')].join('');function%20a(){if(!window.open([f,p].join(''),'mb',['toolbar=0,status=0,resizable=1,width=440,height=430,left=',(s.width-440)/2,',top=',(s.height-430)/2].join('')))u.href=[f,p].join('');};if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else%20a();})(screen,document,encodeURIComponent,'','','https://www.manongdao.com/data/attach/logo/logo.png', '推荐 小情绪 Triste * 的问题《Why is it acceptable for my mail from to be differ》','https://www.manongdao.com/q-644551.html','页面编码gb2312|utf-8默认gb2312'));){kind=link}
There's something that's always bothered me about SPF, why doesn't it validate the From header?
As I understand it, an SMTP server will SPF validate the hostname provided during the MAIL FROM or ENVELOPE FROM SMTP commands (my examples are from telnet'ing to gmail-smtp-in.l.google.com:
MAIL FROM:<matt@example.com>
Gmail then does its thing, making sure my SPF record for example.com permits my IP for sending from. But here's where it seems to fall down, couldn't I just register a domain, set up my TXT and SPF records correctly for my IP, then send? Full example:
$ telnet gmail-smtp-in.l.google.com 25
Trying 173.194.68.27...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP m6si2285029qao.20 - gsmtp
HELO ec2-23-22-210-XXX.compute-1.amazonaws.com
250 mx.google.com at your service
MAIL FROM:<matt@ec2-23-22-210-XXX.compute-1.amazonaws.com>
250 2.1.0 OK m6si2285029qao.20 - gsmtp
RCPT TO:<(a real gmail address)@gmail.com>
250 2.1.5 OK m6si2285029qao.20 - gsmtp
DATA
354 Go ahead m6si2285029qao.20 - gsmtp
From: "Litmus" <hello@litmus.com>
To: <anybody@example.com>
Subject: Welcome to Litmus!
Date: Thu, 27 June 2013 16:24:30 -0500
Welcome!
.
250 2.0.0 OK 1372363723 m6si2285029qao.20 - gsmtp
QUIT
221 2.0.0 closing connection m6si2285029qao.20 - gsmtp
Connection closed by foreign host.
Inspecting the headers from gmail reveals:
Received-SPF: pass (google.com: best guess record for domain of matt@ec2-23-22-210-XXX.compute-1.amazonaws.com designates 23.22.210.XXX as permitted sender) client-ip=23.22.210.XXX;
Looking at the message in Sparrow:
I thought the point of SPF was to help protect my domain (as a sender) from being spoofed? But if the sender has SPF correctly configured (not exactly difficult or expensive to do - I just did it with a free micro ec2 instance above) then it doesn't seem to apply?
I did notice that Gmail put my message in spam in 4 out of 5 tests I performed, but I assume that's because of the reputation of EC2 IPs? Or is there something I'm missing about SPF that Gmail is picking up on?
What am I missing?
I think there is no way to prevent this (I got the answer from other post).
Otherwise, web-generated e-mailer will not work. You could see the example of evite.com and egreetings.com
This might sound circular. It is because the From header cannot be verified in the way you have described.
SPF is not designed to verify header lines in this way.
You have to accept the From: line for what it is, something subject to the whims of the composer of the email.
Remember, even if the email address itself was trusted, many clients display just the stuff in quotes. They would just as easily show what the composer wanted in these two cases:
Do I think this is too liberal? Yeah. Is there anything that SPF can do about it? No.
DKIM is probably what you are looking for, it is focused on header validation.
SPF records can be spoofed unless your SPF record is set correctly I.e your record is set to hard fail -all
Unfortunately most people set their SPF records to soft fail which, as you have described, allows you to spoof the email address
Have a look at http://workaround.org/ispmail/lenny/spf