r/hacking • u/Additional-Camel-248 • 6d ago

Question Email spoof q

I'm trying to send an email with a custom from address for a prank. The domain's SPF is ?all and DMARC is p=none (verified with dig), so receiving servers should deliver it even if SPF/DKIM fail, but I can't change the DNS. The problem I’m running into is the sending side: Gmail SMTP rewrites the From to my own address, and SMTP2GO/Mailgun both want domain verification. I'm considering a VPS with Postfix or cheap shared hosting with PHP mail(). Does anyone know which approach is best, or a provider that still allows custom From addresses without DNS changes? Thank you!

0 Upvotes

33% Upvoted

6 comments sorted by

3

u/Elegabal 6d ago

The problem is that you’re basically asking for a provider that allows email spoofing. SPF ?all and DMARC p=none don’t give you permission to send as that domain, and reputable providers intentionally require domain verification.

-1

u/Additional-Camel-248 6d ago

Yeah, are there any email spoofing tools that still exist and work? My understanding is that the SPF and DMARC settings will make it more likely for the emails to reach the inbox once I actually send them, but I need either some kind of spoofing tool or setting up a VPS

2

u/DutchOfBurdock 6d ago

Let's assume you do manage to spoof, it only takes running a local MTA, the lack of SPF and DMARC will very highly likely trigger spam filters. My MTA automatically shits all over any MTA that lacks these and grey lists them.

1

u/Additional-Camel-248 6d ago

I see.. I clearly don’t have enough experience with this. This email would be from a custom domain (a reputed student organization at my university) and frequently sends out emails to students at my school. Would there still be a problem with their inboxes marking this as spam? As in, is the issue more with me spoofing it or that email inboxes may already not trust this domain

1

u/DutchOfBurdock 6d ago

Very likely their MTA won't allow you to change the from address (reject_sender_login_mismatch).

1

u/Aggressive-Till-137 2d ago

Me when I'm using AI to try and spoof but it won't help me due to ethical purposes