On Thu, 29 Jan 2004, Alain Knaff wrote:
: > MyDoom spoofs its sender addresses at least some of the time.
: > It also sends through its own SMTP engine, rather than ISPs' servers.
: ^^^^^^^^^^^^^^^^^^^^^^^^^
:
: Not so sure about that latter part. This morning, I discovered several
: MyDoom virii sitting in the outgoing queue of the mail server of one
: of the schools that I administer. The mails have been sent by two
: workstations of administrative personnel (the workstations are being
: cleaned right now, and in the meantime 550'ed by our server to prevent
: further spreading).
But the viruses forge senders, so your outbound MX would (in an ideal SPF
world) be barred from relaying the spew outbound unless the forged sender
was in your own domain.
--
-- Todd Vierling <tv(_at_)duh(_dot_)org> <tv(_at_)pobox(_dot_)com>
-------
Sender Permitted From: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
Latest draft at http://spf.pobox.com/draft-mengwong-spf-02.9.4.txt
Wiki:
http://spfwiki.infinitepenguins.net/pmwiki.php/SenderPermittedFrom/HomePage
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname(_at_)©#«Mo\¯HÝÜîU;±¤Ö¤Íµø?¡