Fakemail is useful for some purposes, like sending an email notification to yourself from a script, but it is mostly abused as you might have guessed. Sometimes the results are funny, such as April fools jokes on mailing lists. The Linux kernel mailing list has a off-and-on [tradition] [of] [this]. Probably the most famous fakemail April fools joke was JargonFile:KremVax, although it was actually a UseNet posting.
A more ingenious usage is outright parody, as in the [Case of Danny Hellman], who sent an e-mail as if from Ted Rall, a political cartoonist who had at that time recently written a hatchet job attack of Maus-creator Art Spiegelman. That resulted in drawn out and costly litigation. Fortunately, this type of parody is protected speech under the First Amendment. Most people who have spent a considerable amount of time on the 'Net have witnessed at least one malicious fakemail to a mailing list. [CategoryCase]
Nonetheless, it's rare that you will see fakemail used in a personal attack on someone else. While the cryptonauts will demand everyone switch to PGP, we DefendAgainstParanoia and simply compare the mail headers. They usually are enough to distinguish reality from fiction.
Most people receive several pieces of fakemail a day. We like to call it spam.
Telnet to port 25.
HELO example.com MAIL FROM:firstname.lastname@example.org RCPT TO:email@example.com DATA Date: Thu, 1 Apr 2000 12:34:56 -0500 (EDT) From: firstname.lastname@example.org (Joe Q. Fakemail) To: email@example.com Subject: Hi, I'm fake mail! Reply-To: firstname.lastname@example.org
The universe is a figment of its own imagination. . QUIT
That's about it. The header information (date, from, to subject, reply-to) is normally optional, though some mail clients will bounce messages without it; it does serve to make your e-mail look more authentic.
On systems that have an Authentication Server (RFC 931), spoofing your "MAIL FROM:" line will not work. Send yourself fakemail first to check.
Nearly all mail servers will log the IP address from which the spoof originated in the email itself, making it fairly easy to track down the perpetrator. Some will perform an RDNS lookup. Some have varying levels of authentication built in, and will alert the recipient to inconsistencies in the header. A few servers now require EHELO. An increasing number of ISPs, including Earthlink, perform egress filtering on port 25 for dialup users.