Why can't Hotmail tell the difference between spoof and real emails from a domain (such as blizzard.com)? I get swamped with phishing emails from "blizzard.com" so I put it on my blacklist but then I can't get legitimate emails.

Is there no information in the headers that can be used to definitively determine where the email came from?

  • This probably shouldn't have been migrated, but now it has two answers here it's not feasible to cancel the migration and I don't want to remigrate.
    – ChrisF
    Commented Mar 25, 2011 at 19:43

2 Answers 2

  • SMTP is designed to allow any host relay messages originally sent by another host. For example, I could run a SMTP server for my own domain, but configure server B to accept mail whenever my server is down and forward it later to its destination.

  • Every hop, including the sender (whether legitimate or not), can add any header they wish; for example, a secretary can put the boss' address in From. And so can a spammer. It's not uncommon to see spam with spoofed Received or Date headers too.

  • SPF was created to allow a domain's owner to specify which servers are allowed to send messages claiming to be from that domain. blizzard.com has a SPF record, but either Hotmail does not check it at all or ignores the "reject" rule. Or the fake mail is being sent from an allowed host.

  • Some mail servers (especially the big ones, such as Gmail or Yahoo! Mail) attach a DKIM digital signature to all outgoing messages. However, while this can prove that a message is legitimate, it does absolutely nothing to detect fake messages, because the recipient just does not know whether DKIM was disabled intentionally or not.

    • When DNSSEC becomes widespread enough, it might be possible to check if the sender has published a DKIM key; however, this would cause other problems.
  • There exist ways to digitally sign single messages – PGP and S/MIME – but they, like DKIM, are equally useless against spam.


Problem is that any information which the official Blizzard could put in the headers, the "spoofers" could also put in their headers.

  • 2
    -1 not true: it is practically impossible for "spoofers" to sign a message with DKIM or similar message authentication signature.
    – David Cary
    Commented Mar 25, 2011 at 19:37
  • 1
    @David: This only works if signatures are required by the receiving system. In reality, most just assume that the sender is not DKIM-capable in the first place.
    – user1686
    Commented Mar 25, 2011 at 20:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.