Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

Why can't Hotmail tell the difference between spoof and real emails from a domain (such as blizzard.com)? I get swamped with phishing emails from "blizzard.com" so I put it on my blacklist but then I can't get legitimate emails.

Is there no information in the headers that can be used to definitively determine where the email came from?

share|improve this question

migrated from superuser.com Mar 25 '11 at 19:01

This question came from our site for computer enthusiasts and power users.

    
This probably shouldn't have been migrated, but now it has two answers here it's not feasible to cancel the migration and I don't want to remigrate. –  ChrisF Mar 25 '11 at 19:43

2 Answers 2

up vote 5 down vote accepted
  • SMTP is designed to allow any host relay messages originally sent by another host. For example, I could run a SMTP server for my own domain, but configure server B to accept mail whenever my server is down and forward it later to its destination.

  • Every hop, including the sender (whether legitimate or not), can add any header they wish; for example, a secretary can put the boss' address in From. And so can a spammer. It's not uncommon to see spam with spoofed Received or Date headers too.

  • SPF was created to allow a domain's owner to specify which servers are allowed to send messages claiming to be from that domain. blizzard.com has a SPF record, but either Hotmail does not check it at all or ignores the "reject" rule. Or the fake mail is being sent from an allowed host.

  • Some mail servers (especially the big ones, such as Gmail or Yahoo! Mail) attach a DKIM digital signature to all outgoing messages. However, while this can prove that a message is legitimate, it does absolutely nothing to detect fake messages, because the recipient just does not know whether DKIM was disabled intentionally or not.

    • When DNSSEC becomes widespread enough, it might be possible to check if the sender has published a DKIM key; however, this would cause other problems.
  • There exist ways to digitally sign single messages – PGP and S/MIME – but they, like DKIM, are equally useless against spam.

share|improve this answer

Problem is that any information which the official Blizzard could put in the headers, the "spoofers" could also put in their headers.

share|improve this answer
2  
-1 not true: it is practically impossible for "spoofers" to sign a message with DKIM or similar message authentication signature. –  David Cary Mar 25 '11 at 19:37
1  
@David: This only works if signatures are required by the receiving system. In reality, most just assume that the sender is not DKIM-capable in the first place. –  grawity Mar 25 '11 at 20:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.