Hacker News Reader

Hacker News

Comment by Xuebit | Hacker News Reader

Parent Full thread

Xuebit

It is very easy to spoof an email address[1], so it could be that it is someone from outside of FedEx.

https://superuser.com/questions/505503/how-can-you-fake-an-e...

View on HN

However you can still check the IP address of the mail server that sent the mail. Some things to look at:

1. Check PTR for IP and verify that the A or AAAA record for that name points back to the same IP.

2. Compare with IP address of server that sent previous mail to you.

3. Check SPF records for the domain.

4. Check MX records for the domain. Keep in mind that they might be using different servers for sending than for receiving though and that MX is for receiving.

These sound like good steps to determine if a sender is legitimate. Is there a plugin that already does this for existing email clients?

Google gmail and inbox both show this information if you click the "view full message" option on any particular email

I'm pretty sure GP means Is there a client that runs this check in the background, and either tells you or marks it Spam.

With SPF, DKIM, DMARC, coupled with blacklists and the reputation system of big mail providers that's making it difficult to host your own email, it's actually quite to impersonate an email address.

Try it, then see how many times you can hit a @gmail address.

I found that this does not stop one from sending emails that appear to originate from addresses like info@paypal.com as long as the contents of the email are different from known spam emails. They are not flagged by GMail at all as long as you send them from a reputable email server through services like mailgun.com.

SPF will catch these really easily.

Sure but if the link leads to the actual FedEx website then what would be the point?

One possibility is the "Hostile Subdomain Takeover" attack recently mentioned here, where an attacker could have control of, say, help.fedex.com https://news.ycombinator.com/item?id=14860149

Reply on news.ycombinator.com