Hi,
Me and my buddy had a interesting discussion, which i thought could put
across the geeks here.
It goes something like this:
SMTP is currently a push protocol and is initiated by the the sender, no
controlling that fact.
But it is possible to overcome the relay problems, IP spoofing and domain
impersonation etc,
by making the servers pull the mails.
1. Sending server contacts the destination and proovides the Message ID and
sender details(and other details) and disconnects the session.
2. The receiving server queues it up and looks up the messages one by one
using DNS to determine their legitimacy.
3. If the IP that contacted is legitimate(can be verified by say SPF?), it
contacts the sender and provides the message ID with other details.
4. The sending server then hands over the message.
5. To overcome DDoS attacks, the receiving server can be made to request the
next 10 or so Message IDs that it will assign to messages,
so that if a attacker tries to give those details, it will know from the
next list of message IDs that it's fake connection.
6. May be by this collection of data, the IP addresses can be reported to a
RBL and blacklisted.
Please point the holes in this model, so that we might get a entirely new
insight.
Note: I have gone trough IM2000 and other similar discussions in the
archive. Just thought this version of C/R is worth getting discussed.
Regards,
Ravi
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg