On Fri, 14 May 2004, Jon Kyme wrote:
Well you do seem very sure, so how do we explain:
Most MTAs will not 550 an invalid MAIL FROM because that prevents people
with broken setups from email postmaster to get help with their
communication problems. Instead they will 550 the subsequent RCPT TO
commands complaining about an invalid sender address.
:; telnet mx.cam.ac.uk smtp
Trying 131.111.8.4...
Connected to purple.csi.cam.ac.uk.
Escape character is '^]'.
220 purple.csi.cam.ac.uk ESMTP Exim 4.20 Fri, 14 May 2004 16:30:47 +0100
EHLO chiark.greenend.org.uk
250-purple.csi.cam.ac.uk Hello chiark.greenend.org.uk [193.201.200.170]
250-SIZE 104857600
250-PIPELINING
250 HELP
MAIL FROM:<abcd(_at_)e(_dot_)f(_dot_)g(_dot_)h>
250 OK
RCPT TO:<fanf2(_at_)cam(_dot_)ac(_dot_)uk>
550-Verification failed for <abcd(_at_)e(_dot_)f(_dot_)g(_dot_)h>
550-Unrouteable address
550 Invalid Sender Address
quit
221 purple.csi.cam.ac.uk closing connection
Connection closed by foreign host.
--
Tony Finch <dot(_at_)dotat(_dot_)at> http://dotat.at/
Yours != mine != "most"
Well, let's have another go at poor old Hotmail:
220 mc12-f4.hotmail.com Microsoft ESMTP MAIL Service, Version:
5.0.2195.6824 ready at Fri, 14 May 2004 08:43:41 -0700
ehlo there
250-mc12-f4.hotmail.com (02.04.01.0013) Hello [nnn.nnn.nnn.nnn]
250 OK
mail from: gfgfg(_at_)hkakasgcbasjfd(_dot_)com
250 gfgfg(_at_)hkakasgcbasjfd(_dot_)com(_dot_)(_dot_)(_dot_)(_dot_)Sender OK
rcpt to: ivesnippedthis(_at_)hotmail(_dot_)com
250 ivesnippedthis(_at_)hotmail(_dot_)com
data
354 Start mail input; end with <CRLF>.<CRLF>
Subject: Test
Blah
.
250 <MC12-F4M4mZDmNLkRYf00077b64(_at_)mc12-f4(_dot_)hotmail(_dot_)com> Queued
mail for
delivery
And indeed, it's delivered.
Some installations don't do this kind of sender verification. I'm afraid I
don't have the figures to hand, but the last time I checked on our systems,
the vast majority of messages that would have been caught by this kind of
check were from blacklisted peers. So were stopped more cheaply.
Personally, I'd agree that receivers probably should do the check you
suggest, but I'm not so sure that "most" do, or that "most" inboxen are
protected in this way.
Unless a "fact" can be backed up, it probably shouldn't be asserted so
baldly.