Daryl Odnert wrote:
To put it in simple terms, you cannot launch this type of attack
against V using P using unless one of the following is true:
(1) P is an open relay.
(2) The attack messages are sent to P from an IP address that
normally sends mail for domain V.
(3) IP address spoofing is used to make it look like the attack
message is coming from an IP address that normally sends mail for
domain V.
(4) The attack messages are sent to P from an IP address that P
considers to be part of its own management domain, and it puts no
restrictions on either the MailFrom or the From header field from such
IP addresses.
I believe (4) applies to the overwhelming majority of ISP's submission
hosts, including all three ISPs that I use regularly, and every hotel,
airport, and public WiFi I've used in the past year.
<csg>