FiercePhish icon indicating copy to clipboard operation
FiercePhish copied to clipboard

Feature Request: Envelope-From Spoofing

Open ad0nis opened this issue 7 years ago • 1 comments

Allow the sender to specify if they want to put a different sender name and email address in the Envelope-From header (The "From:" header which goes inside the DATA block of the email.), separate from the SMTP "MAIL FROM:" header. This can allow you to send your legitimately SPF/DKIM-validated message from the domain you own, while presenting the target's actual email domain within their mail client. (Not all mail clients are susceptible to this, and some spam filters may treat this negatively, but in some cases, it's a good social engineering technique.)

ad0nis avatar May 02 '17 23:05 ad0nis

This is actually a solid idea. I know that mailgun does do this, so that is a decent workaround for right now. I think adding a section for "Advanced settings" for both campaign emails and simple send should be a good and scalable for the future. I will add this as an enhancement for future versions

Raikia avatar May 03 '17 19:05 Raikia