Sending server side emails - with spoofed From: header

Discussion in 'Programming' started by foobaa, Mar 2, 2007.

  1. #1
    Ok I imagine this is a contraversial topic, but then again, not, if used sensibly.

    I'm creating a "tell a friend" page for a client. Someone puts in their email address, a friends' email address, and a custom promotional message is sent to the friend's email address, looking as if it came from the user.

    Ebay does this, if a user sends a message through the ebay system, it goes to the third party, and the From field is that of his email address, not ebay or anything. Plenty of other examples out there.

    I've tried doing this, except it always goes to my spam box (gmail) even though ebay and others work fine. I've tried to replicate what they do by fiddling with the headers, but as always with emails I end up guessing.

    Return-Path: me@mydomain.com
    Sender: me@mydomain.com
    From: someoneyouknow@yahee.com

    Other than this, I'm not sure what's going wrong. As soon as I change the From field to be that of my domain, it passes the spam test, but obviously it's not what I've been asked to do!

    Thanks in advance for any help
    Jodes
     
    foobaa, Mar 2, 2007 IP
  2. bscdesign.com

    bscdesign.com Active Member

    Messages:
    681
    Likes Received:
    9
    Best Answers:
    0
    Trophy Points:
    58
    #2
    This is from the Tell-A-Friend script I distribute:

    From: $FORM{'sender'}
    Reply-To: $FORM{'sender'} ($FORM{'sender_name'})

    It works perfectly. When the receiver replies to it the email is sent to what ever email address the sender typed into the form field.
     
    bscdesign.com, Mar 3, 2007 IP
  3. foobaa

    foobaa Peon

    Messages:
    27
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Hi bscdesign,

    Thanks for your quick (weekend!!) response. I tried your form first - and the email came straight through to my inbox.

    I tried setting the From: and Reply-To: headers in my script as you said - it went straight to spam sadly.

    Are there any other headers I should or shouldn't have? I tried comparing the output of your script to mine (as I have with other emails that fake the From: header) and don't really know what I'm looking for!

    It has a neutral Received-SPF header whereas yours has a pass, (although I thought neutral should be fine anyway as ebay has neutral and they get straight to my inbox)

    The headers at my gmail from my script are as follows:
    
    Delivered-To: jody.florian@gmail.com
    Received: by 10.115.93.14 with SMTP id v14cs728014wal;
            Sat, 3 Mar 2007 14:45:42 -0800 (PST)
    Received: by 10.67.117.18 with SMTP id u18mr6455777ugm.1172961941821;
            Sat, 03 Mar 2007 14:45:41 -0800 (PST)
    Return-Path: <noreply@dev.blueperfection.co.uk>
    Received: from localhost.localdomain (82-68-11-177.dsl.in-addr.zen.co.uk [82.68.11.177])
            by mx.google.com with ESMTP id b33si10288872ika.2007.03.03.14.45.41;
            Sat, 03 Mar 2007 14:45:41 -0800 (PST)
    Received-SPF: neutral (google.com: 82.68.11.177 is neither permitted nor denied by best guess record for domain of noreply@dev.blueperfection.co.uk)
    Received: by localhost.localdomain (Postfix, from userid 33)
    	id 216CA284451; Sat,  3 Mar 2007 22:46:53 +0000 (GMT)
    To: jody.florian@gmail.com
    Subject: Come on you SOAB
    From: baz@chocolate.com 
    Reply-To: baz@chocolate.com (Bazza)
    Message-Id: <20070303224653.216CA284451@localhost.localdomain>
    Date: Sat,  3 Mar 2007 22:46:53 +0000 (GMT)
    Code (markup):
    I can post the headers at my gmail from your script, or from one ebay or someone else has sent me if it helps at all...

    Thanks!
     
    foobaa, Mar 3, 2007 IP
  4. bscdesign.com

    bscdesign.com Active Member

    Messages:
    681
    Likes Received:
    9
    Best Answers:
    0
    Trophy Points:
    58
    #4
    This is the full header in my script:

    To: $FORM{'recipient'}
    From: $FORM{'sender'}
    Reply-To: $FORM{'sender'} ($FORM{'sender_name'})
    Subject: $FORM{'subject'}

    You really don't need any more than that. Can you give me the URL to your test script. It can't hurt to double check with my Gmail account.

    Also I hope you aren't using my exact examples. Replace the variable with the variables in your script that hold the form data that fit in each spot.
     
    bscdesign.com, Mar 3, 2007 IP
  5. foobaa

    foobaa Peon

    Messages:
    27
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    I think I must have chosen email addresses and domains which didn't exist every time without fail, DOH

    Thanks for persevering with me!

    New favourite quote lol: "Stupidity has a knack of getting its way"

    All the best
     
    foobaa, Mar 4, 2007 IP