SMTP 可以接受带有虚假发件人姓名的电子邮件
我正在使用 SMTPClient 将电子邮件发送到 SMTP 服务器。但使用 Send 方法，我可以指定任何虚假的发件人姓名或电子邮件。我怎样才能防止这种情况发生？
I'm using SMTPClient for sending emails to a SMTP server. But with Send method I can specify any false sender name or email. How can I prevent this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您的邮件服务器负责决定接受什么作为发件人电子邮件地址 - 这只是一个策略问题。
邮件客户端没有“真实”的电子邮件地址，因此无法在客户端强制执行任何操作。
It's the job of your mail server to decide on what it accepts as a sender email address - that's just a matter of policy.
There is no 'true' email address for a mail client, so nothing that can be enforced at the client.
我认为这应该是 SMTP 服务器的角色来决定发件人名称是否有效。事实上，在代码中引入它违反了 DRY 规则，因为您将复制 SMTP 配置。
正如您在 http://msdn. microsoft.com/en-us/library/swas0fwc%28v=VS.90%29.aspx，您应该只准备捕获 SmtpException 并将其正确显示给软件的用户。
I think that should be the SMTP server's role to decide whether a sender name is valid or not. In fact, introducing it in your code is a violation of the DRY rule since you'd be replicating the SMTP configuration.
As you can see in http://msdn.microsoft.com/en-us/library/swas0fwc%28v=VS.90%29.aspx, you should only be prepared to catch SmtpExceptions and properly display them to your software's user.
您无法在 SmtpClient 中对此执行任何操作。
您可以在您的应用程序中对此做一些事情。发送一封验证电子邮件，用户必须单击该电子邮件才能验证其电子邮件。
您可以在您的 smtp 服务器中对此进行处理。检查 MX 记录或针对发件人域/IP 地址定义的 SPF 策略。
You can't do anything about it in the SmtpClient.
You can do something about it in your application. Send a verification email that the user must click on to validate it's email.
You can do something about it in your smtp server. Check the MX record or the defined SPF policies against the sender domain/ip address.
SMTP 是一种邮件传输协议（顾名思义）。它不负责验证发件人的身份。为了验证发件人的身份，您需要使用 SMTP 支持的证书，但同样，这只是作为一种传输手段。程序本身需要具有使用证书对发送者进行身份验证的逻辑。
您还可以使用身份验证，但在这种情况下，将由 SMTP 服务器将用户名/密码与电子邮件地址进行匹配。
SMTP is a mail transfert protocol (as the name implies). It's not in charge of authenticating the sender. To authenticate the sender, your need to use certificates, which SMTP supports, but again, just as a mean of transfert. The program itself needs to have the logic to authenticate the sender with the certificate.
You can also use authentication, but in that case it'll be the SMTP server that will match the username/password with an email address.