Using a Google Loophole to Create Unlimited Custom School Emails

Jamisen Renoud

May 9th, 2025

It would be a big risk to allow students to create any email on your schools domain, students could create stuff like staff@school.org and launch phishing attacks with an official looking school footer, and ask for payment for a school trip or something. I wasn't even looking to find this, but I was messing around with all of Google's tools on my school account, and went to the groups thing. This is meant to be used for well, groups and is like a Google 4chan message board.

Now im at the groups page, and I was just going to create a group, but I saw one field that made me interested.

I saw the email part, and wanted to look further, so I just filled it out with an email.

Now I have created the group, and am just going to make a post.

We are now at a kind of Gmail looking ui.

But, if we click the from section, we can now send from our groups email instead of ours, but theres no send field! So what can we do about this?

Well, if you look over in the right, you can see a Cc button, and now we can input somebody to Cc on the email, effectively just sending it to them.

First im going to try sending to my personal email.

And it infant worked! As you can see it sent and the from has the email we setup.

Next I tested it with my school email (and my friends School email).

And it worked, showing that this really does work.

Pretty nifty find! (Responsibly disclosed and fixed before this was published)

This post is licensed under the Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0) license.