Why can't Hotmail tell the difference between spoof and real emails from a domain (such as blizzard.com)? I get swamped with phishing emails from "blizzard.com" so I put it on my blacklist but then I can't get legitimate emails.

Is there no information in the headers that can be used to definitively determine where the email came from?

  • This probably shouldn't have been migrated, but now it has two answers here it's not feasible to cancel the migration and I don't want to remigrate. – ChrisF Mar 25 '11 at 19:43
  • SMTP is designed to allow any host relay messages originally sent by another host. For example, I could run a SMTP server for my own domain, but configure server B to accept mail whenever my server is down and forward it later to its destination.

  • Every hop, including the sender (whether legitimate or not), can add any header they wish; for example, a secretary can put the boss' address in From. And so can a spammer. It's not uncommon to see spam with spoofed Received or Date headers too.

  • SPF was created to allow a domain's owner to specify which servers are allowed to send messages claiming to be from that domain. blizzard.com has a SPF record, but either Hotmail does not check it at all or ignores the "reject" rule. Or the fake mail is being sent from an allowed host.

  • Some mail servers (especially the big ones, such as Gmail or Yahoo! Mail) attach a DKIM digital signature to all outgoing messages. However, while this can prove that a message is legitimate, it does absolutely nothing to detect fake messages, because the recipient just does not know whether DKIM was disabled intentionally or not.

    • When DNSSEC becomes widespread enough, it might be possible to check if the sender has published a DKIM key; however, this would cause other problems.
  • There exist ways to digitally sign single messages – PGP and S/MIME – but they, like DKIM, are equally useless against spam.


Problem is that any information which the official Blizzard could put in the headers, the "spoofers" could also put in their headers.

  • 2
    -1 not true: it is practically impossible for "spoofers" to sign a message with DKIM or similar message authentication signature. – David Cary Mar 25 '11 at 19:37
  • 1
    @David: This only works if signatures are required by the receiving system. In reality, most just assume that the sender is not DKIM-capable in the first place. – user1686 Mar 25 '11 at 20:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.