On Wed, 17 Jan 2001 23:20:37 +0100, Ralf Koch
What exactly is the issue you want to point out? Almost everybody running a computer with an email client connected via dial-up to an internet provider can set his sender address to any address he wanted.
Right. But although the user controls the "From:" address, the ISP controls the envelope address. The site performing final delivery looks at the envelope address to determine "Return-Path:" so that bounces will come back where they originated, and also making the email traceable to its real source.
They replied that they had a form on the web where users can specify the sender address and send emails to anyone.
Hmmm ... suppose the ISP takes the user input from the web form, and then calls sendmail as a trusted user with the -f option, setting the envelope address to whatever the user entered? I would not be too surprised to learn of ISPs doing that. Egan