Hey guys,

I need your help validating what I would call a serious email bug. I'm on the latest version of Enhance. I did report this to Adam in Feb 2023 but for me it's still present after the email overhaul.

TL;DR: Customers can send as any email account (via PHP), and it's received by the recipient as a valid email (just as if the customer sent it via an authenticated SMTP transaction via the email client). "Valid email" = DKIM, SPF, DMARC = Passed

My Setup

Smart Host enabled via Amazon SES
Added domain.com as a valid identity to SES
Latest version of Enhance
Customer 1 account has an email customer1@domain.com and Email is assigned as Server1
Customer 2 has no emails but has assigned Email as Server1

To reproduce

Login to Enhance and impersonate Customer 2
Add a file named email_test.php to public_html with the following content:

<?php

$to = "ANY_EMAIL_I_USED@GMAIL.COM";
$subject = "Password Change";
$txt = "Change your password by visiting here";
$headers = "From: customer1@domain.com";

mail($to, $subject, $txt, $headers);

?>

Make sure the $headers variable is using the same email as Customer 1 (customer1@domain.com)
Execute the script in your browser
Look at the headers of the received email at the recipients email

In the end, I was expecting Gmail is block it, mark it as spam, or whatever, but the fake email is routing through Amazon SES as a legitimate email. I think I was even expecting the Customer 2 to be blocked immediately as they do not have permission to send an email from Customer 1 however, I'm well aware that it should have come from Customer 2's "system email account" instead.

Questions

Does this happen to you?
I see mailbaby integrations a lot; does this happen with mailbaby?
I do not have the facility to test without a smart host; but if anyone is not using a smart host; does this happen to you?

Thanks,
Sully