ietf-asrg
[Top] [All Lists]

[Asrg] Re: 1a. Inventory of Problems - Spoofed mail addresses

2004-02-05 14:18:47
Brett Watson wrote:
Scenario: party A sends mail to party B at the request of party C. Example: Chris wants publisher Aardvarks.example.com to mail an article to Bob. The subsequent mail transaction has Aardvarks.example.com as the SMTP-sender, and Bob's mail server as the SMTP-receiver. "MAIL From:" is given as a bounce-handling address at Aardvarks.example.com (possibly utilising VERP), which allows an LMAP-like system to bless the use of the given address. This would not be possible if Chris' address were used at this point. "RCPT To:" is given as Bob's address. In the message itself, "Sender:" is an appropriate Aardvarks.example.com address, "From:" is Chris' address, and "To:" is Bob's address. If the message is refused for any reason, the bounce-handler at Aardvarks.example.com is in a position to notify Chris of this failure via email.

IMHO there are no 100% solution to this situation. (Other than the copy-paste "solution".)

If Aardvarks.example.com will be the MAIL FROM than MTA doing white-list filtering at the SMTP level will refuse this email even the white-list contains the email address of Bob.

If Bob's address will be the MAIL FROM than MTA with transport path enforcing filter will refuse the email.

If both Aardvarks.example.com and Bob are in the MAIL FROM: (source route notation) then non RFC compliant MTAs will refuse or mishandle the email.



z2


_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg