Unfortunately, Gmail doesn’t really hide your “real” e-mail address behind the “not as real” one: you can find the real e-mail in the e-mail headers, in the sender field. Here is an example header (modified to hide e-mails and stuff, of course ):

MIME-Version: 1.0
Sender: thenicknameiwanttohide@gmail.com
Received: by 10.229.89.1 with HTTP; Tue, 30 Jan 2011 07:32:45 -0800 (PST)
Date: Tue, 30 Jan 2011 16:32:45 +0100
Delivered-To: someguy@somewhere.com
X-Google-Sender-Auth: sm8dg5Gdqs84gqswcxfzDFpS9s6
Message-ID: <randomstringrandomstringrandomstringrandomstr@mail.gmail.com>
Subject: =?ISO-8859-1?Test_email?=
From: The name I want to show <thenameiwanttoshow@mydomainname.com>
To: someguy@somewhere.com
Content-Type: multipart/mixed; boundary=001365494266e56a1f6198741347

Now, this doesn’t really seem to be a big issue since, unless you’re sending spam big time, noone will ever check the headers of the e-mails you send them. This becomes a problem, however, once you consider that some (many?) e-mail providers will display your “hidden” e-mail as the sender of the e-mail… voiding all your precious forging efforts.

At this point, I guess that you’ll want names Well, here is a short list:

• Hotmail, of course. They display forged sender as: “realemail@gmail.com from Your forged name”
• Yahoo! Just the same as Hotmail.
• Outlook. I don’t remember precisely what they display, plus maybe this depends on the configuration (I observed that at a company where I worked), but they do display the unforged e-mail.

In case you’re wondering (and too lazy to test ), Gmail on the other hand behaves properly and display the forged e-mail (granted that the contrary would be quite shocking though).

So, in conclusion, when you really need to spoof your e-mail address, you’d better really write from the box from which you want it to appear to come. Or at least check if the recipient’s e-mail provider doesn’t bust forged e-mails.

Read more