On Thu, Apr 30, 2026 at 18:02:25 +0100, Joe wrote: > Once SMTP servers started refusing connections from dodgy senders (no > PTR record, no complementary A/PTR pair, etc.) it was realised that some > SMTP servers would still accept the mail. Forging the From: header to > the real target of the spam would cause this person not to be found by > the gullible SMTP server, so it would bounce the *entire* spam message > 'back' to the alleged sender. The bounce came from a 'legitimate' > sender, so was accepted by the intended target SMTP server and > delivered to the recipient.
For the record, this kind of attack involves falsifying the envelope sender address, not the From: header. Bounce messages are sent to the envelope sender. The From: header is strictly ornamental as far as SMTP is concerned, though some MTAs may use it in their spam detection heuristics, or in their client email acceptance policies.
