How To Spoof An Email Address In 5 Steps

Understanding how to spoof email addresses is an essential part of running any successful red-team exercise or phishing simulation, particularly when a majority of domains are vulnerable to spoofing in some way, shape, or form!

In this blog, we'll provide a detailed walkthrough on what email authentication protocols are vulnerable to spoofing, how to identify these vulnerabilities at scale, and how to spoof an email address while passing email authentication checks.

Jump To How To Spoof An Email Address

Understanding The Basics

Before we delve straight into vulnerability exploitation, let's cover some fundamentals.

What Is Email Address Spoofing?

Email address spoofing is where someone forges an email address and email display name to appear as though it's from a trusted entity or individual.

Under normal circumstances, email address spoofing shouldn't be possible. If you've heard the acronyms SPF, DKIM, or DMARC, you probably know why. These are all email authentication protocols meant to prevent email spoofing.

It's crucial to acknowledge this because by understanding how these protocols work, we can understand how they can be abused and even bypassed if not configured correctly.

How Is SPF Bypassed?

To answer this, we need to deep-dive into how emails are sent and received.

When an email is received by an email client such as Gmail or Outlook, only a portion of the email is visible to the recipient. The visible portion of an email is called the email content, while the email envelope, which is predominantly used for routing purposes, is hidden from plain view (only visible by viewing the message headers).

It's important to make this distinction between visible and hidden information because this is where there's an inherent vulnerability in the way SPF operates. Cybercriminals can exploit this vulnerability through an attack known as SPF-bypass.

As can be seen in the screenshot above, there are two locations where the from address is specified. The first "mail from:" address located in the email envelope is where SPF authentication checks occur. But as mentioned earlier, everything in the email envelope is hidden from plain view. The second "from:" address located in the email content is what the recipient of the email actually sees in their email client.

Naturally, this raises a question. What if we misalign the "mail from" address in the email envelope with the "from" address in the email content?

This is exactly how an SPF-bypass attack occurs. Cybercriminals will use a domain that they control in the email envelope "mail from" address (that passes SPF checks); they then use the domain of an entity they want to spoof in the email content "from" address.

This is a glaring weakness in the way SPF operates, and it's something that the maintainers of the SPF protocol noticed shortly after its creation, so to prevent spoofing attacks of this nature, a new superseding protocol was created, DMARC.

How To Spoof An Email Address Using SPF-Bypass

Step 1. Identify A Vulnerable Domain

To spoof an email address, we need to identify a domain that either doesn't have a DMARC record set up or is configured in a way where the DMARC record 'p' qualifier is set in a 'None' non-enforcement configuration.

There are a variety of manual and automated ways to perform these scans, namely running manual searches using the 'dig' command line utility, the email domain scanning tool here at CanIPhish, or even the CanIBeSpoofed open-source project.

Image Reference: Example depicting a dig DMARC query against the wikipedia.org domain (Update: As of July 2024, Wikipedia has hardened their DMARC record).

As an example, we can see that wikipedia[.]org doesn't have an adequately configured DMARC record, so we'll use this example for the remainder of the walkthrough.

Step 2. Obtain An Email Server

This part is easier said than done. Most cloud infrastructure providers prevent the ability to send outbound SMTP emails over TCP port 25 due to the risk of cyber criminals abusing their infrastructure with malicious intent (e.g. Azure requires an Enterprise Agreement before port 25 will be unlocked). There are various means of legitimately gaining access to infrastructure that supports outbound email delivery, particularly if you work with a large business or institution.

We can proceed with the next step once you have an email server, ideally with a Linux-based operating system that can communicate outbound over TCP port 25.

Step 3. Obtain An Attacker Domain

Earlier, we talked about how SPF-bypass attacks abuse a misalignment between the email envelope and email content from addresses. To take advantage of this misalignment, we must provide a domain we control (i.e., an attacker domain) in the email envelope "mail from" address, which is where SPF authentication is performed, while providing the domain we're spoofing in the email content "from" address.

In preparation for sending an email with a spoofed email address, we need to procure an attacker domain and set up its SPF record so the public IP address attached to the email server setup in Step 2 is listed as an authorized sender.

Accordingly, we need to purchase a domain from a domain registrar such as GoDaddy, Amazon Route 53, or any of the hundreds of registrars out there. This can be any domain you choose (ideally, one that's non-descript and generic).

Once purchased, we need to set the SPF record as follows (replacing <IP-ADDRESS> with the public IP address of your email server):

Step 4. Prepare The Email Spoofing Script

Now that we've identified a vulnerable target domain, we have our email server, our attacker domain, and the corresponding SPF record all set up; we're ready to send out our email with a spoofed email address!

To send this email, we'll be modifying the below script to suit our needs. So copy it out and paste it into your favorite text editor.

Note: The script above is a slightly modified version from the SPF-Bypass GitHub Project.

Step 4.1. Specify The Target Email Server

To find the email server of our intended target, we'll need to run an MX dig command against the target domain (replacing <target-domain> with the domain of our target recipient). Once run, extract the relevant mail server and update the script by replacing <target-mail-server> on line 1 with the mail server address.

Image Reference: Example depicting a dig MX query against the caniphish.com domain.

Step 4.2. Specify The Attacker Domain

Replace <attacker-domain> on line 2 with your attacker domain and <attacker-email-address> on line 3 with an email address at your attacker domain.

Note: The local-part address (i.e. everything before the @ symbol) doesn't have to be real, we just need the domain to be real.

Step 4.3. Specify The Target Email Address

Replace <target-email-address> on lines 4 and 7 with the email address of your intended target.

Step 4.4. Specify The Spoofed Email Address

On line 6, replace <spoofed-display-name> with your preferred display name, and %spoofed-email-address% with the email address that you intend to spoof.

Note: Make sure %spoofed-email-address% still has angle brackets around the email address (e.g. <admin@caniphish.com>). This is a formatting requirement for delivering SMTP emails.

Step 4.5. Personalize The Email Body

Replace the subject on line 8 with your preferred subject. Ideally, it should be something for demonstration purposes, and then enter any text you wish below the subject for the email body.

You're now ready to send the email with a spoofed email address!

Step 5. Send An Email With A Spoofed Email Address

Step 5 builds from step 4; please keep your modified script open in your text editor.

Image Reference: Example depicting the delivery of an email with a spoofed email address via telnet.

Step 5.1. Connect To The Target Email Server

Copy line 1 to your clipboard. Paste and then submit the command to your email server's console.

Note: You may need to install telnet on your email server.

Step 5.2. Input The Email Envelope

Copy lines 2-4 to your clipboard. Paste and then submit the sequence of commands to your email server's console.

Note: You will need to press enter twice, as the email server will acknowledge the sender and recipient addresses.

Step 5.3. Transition From The Email Envelope To The Email Content

Copy line 5 to your clipboard. Paste and then submit the command to your email server's console.

Step 5.4 Input The Email Content

Copy lines 6-11 to your clipboard. Paste and then submit the sequence of commands to your email server's console.

Step 5.5 Send The Email

Enter a full-stop "." to notify the target email server that your email is complete and ready for processing. You should receive an immediate notification that the email has been queued for delivery!

Note: If you experience any difficulties with sending the email while following steps 4.6 to 4.10, it could be because your email server doesn't have a trusted IP address or that the target email server needs the commands to be processed in a slightly different format (e.g., surrounding all domains and email addresses with angle brackets).

Step 5.6 Check Your Email Client

After a minute or so, you should receive the email in your inbox. When analyzing the email headers, you should notice the mismatch between the SMTP.MailFrom (i.e., Mail Envelope From) and email content from address.

Image Reference: Example depicting an email with a spoofed email address that's passed SPF authentication in Gmail.

Conclusion

Due to the growing popularity of email spoofing among the cybercrime community, it's becoming increasingly essential to utilize spoofing as part of red-team exercises and phishing simulations.

If you'd like to incorporate this technique into your employee training program without the hassle of obtaining and maintaining your own dedicated attacker infrastructure, create a free account and access the CanIPhish Cloud Platform.

Frequently Asked Questions

What is the Sender Policy Framework (SPF)?

SPF is an email authentication protocol, which is essentially a large list of IP addresses that are published through a public DNS record (known as an SPF record). Each IP address in an SPF record is considered an email sender who is authorized to deliver emails on behalf of a given domain.

Let's say I wanted to deliver an email from an email address at the caniphish.com domain. To do this, I need to send the email from a server with a public IP address listed in the caniphish.com SPF record. If I used an IP address that's not in the SPF record, then the receiver of that email would fail the email authentication check and reject the email as a likely spoofing attempt.

So, now that we know what SPF is, let's answer the following question.

What is Domain-based Message Authentication, Reporting & Conformance (DMARC)?

DMARC is an email authentication protocol that has a range of functionality, and like SPF, it's a public DNS record. Importantly, it's meant to protect against SPF-bypass attacks.

It does this by enforcing an alignment check against the email from addresses listed in both the email envelope and the email content. If there's a misalignment, the DMARC authentication check will fail, which then causes the email client to reject the email in its entirety.

The problem is that knowledge of how this protocol protects against SPF-bypass attacks is poorly understood on a global scale. A scan conducted in 2022 against 1.7 million Australian domains showed that nearly 60% of all domains were vulnerable to an SPF-bypass attack because their DMARC record either didn't exist or was configured in a non-enforcement mode.

Now that we know how email addresses can be spoofed and what's meant to prevent said spoofing let's delve into how you discover these vulnerabilities and ultimately spoof an email address.

Why Do Attackers Use Email Spoofing?

One of the most complex parts of conducting a successful phishing attack is making the target of a phishing email believe the sender is legitimate and trustworthy.

In many cases, attackers will use company logos, brand names, and familiar terminology to exploit this trust factor, but the most impactful technique is spoofing the domain from which an email appears to come.

How Can I Protect Against Email Spoofing?

Protection against email spoofing is a two-pronged process.

First, you need to protect your domain from being spoofed. You can do this by implementing the email authentication protocols for your domain in a hardened configuration (i.e., SPF, DKIM, and DMARC).

Second, you must ensure your email gateway can interpret the results of email authentication lookups for any email you receive. By analyzing these results, you'll be well-equipped to spot potential spoofing attacks and filter or block emails.

What's The Difference Between Email Spoofing And Lookalike Domains?

Email spoofing and lookalike domains are fundamentally different.

Email spoofing relies on exploiting technical weaknesses to forge an email address that exactly matches that of a trusted sender.

Lookalike domains occur when attackers purchase a domain that looks similar to but is materially different from the domain of the organization they're attempting to masquerade as. Attackers commonly transpose certain characters to make the domain seem unchanged to the naked eye.

What Are All The Different Ways To Spoof An Email?

Email addresses can be spoofed through five distinct types of attacks, namely:

1. Email spoofing through abuse of an inadequately configured DMARC record: This technique abuses a configurational weakness in DMARC records (i.e., the method outlined in this blog)..
2. Email spoofing through DNS takeover: This technique abuses DNS records and allows an attacker to configure SPF or DKIM records maliciously.
3. Email spoofing through Dangling IP takeover: This technique abuses an unregistered IP address that is accidentally listed in an SPF record.
4. Email spoofing through DKIM private key exposure: This technique abuses the exposure of a DKIM private key, allowing an attacker to sign DKIM authentic emails maliciously.
5. Email spoofing through email server compromise: This technique abuses the compromise of an email server, allowing an attacker to send emails from legitimate sender infrastructure.