spf-discuss
[Top] [All Lists]

Re: SV: Security Paper on forgery bounce DDoS

2004-04-19 03:18:28

On Apr 19, 2004, at 2:53 AM, Tony Finch wrote:

On Mon, 19 Apr 2004, Lars Dybdahl wrote:

- Be able to receive bounces. Cookies in sent e-mails are one way to
ensure, that you only get the correct bounces, so SES might be a
technique here, but CBV is not necessary.

Some legitimate bounces (e.g. vacation messages) don't include the
original message, so cookies in anything other than the reverse path are
not a complete solution.

... and of course lots of vacation messages are not using the envelope sender, so even that won't work.


 - ask

--
http://www.askbjoernhansen.com/