Mark Shewmaker wrote:
It would be convenient for MUA's if there were a header item
that said: "I fully and completely trust the previous MTA."
MTA's internal to an organization could be configured to
always proclaim full trust in their border MTA's.
MUA's reading mail from those internal MTA's would then be
able to trust the authentication headers added way back at the
the border MTA--and all without any user-level
configuration whatsoever.
Alex wrote:
Received: by MUA
Received: from_trusted virusscanner.example.org
by spamassassin.example.org
[...]
Received: from_trusted mxhost.example.org
by virusscanner.example.org
[...]
Received: from spamhost.spamhouse.invalid
by mxhost.example.org
[...]
Received: from_trusted goodguy.example.net
[...]
Received-SPF: [... resulting in PASS]
X-Spam-Flag: no
[...]
The MUA need not have knowledge about the infrastructure yet it
does know it cannot trust "Received-SPF:"
This proposal could work. The trust chain stops as soon as a
"Received: from " (note last space) is seen. Ignore any information
after that line.
Hmm, this sounds awfully reminiscent of finding an edge-server in the
Caller-ID spec. Quoting a bit from Section 3.3.1.2:
"Locating the Received: header added by your organizational edge would be
trivially easy if two conditions were met.
1. There existed some distinguished character string s that all edge SMTP
servers in your organization placed in the Received: headers that they add
to incoming messages.
2. The string s was not present in the Received: headers added by any of
the non-edge SMTP servers in your organization."
To that end, one would publish something like:
<ep xmlns="http://ms.net/1";>
<internal>
<edgeHeader>***example.com edge***</edgeHeader>
<edgeHeader>mx.example.com</edgeHeader>
</internal>
</ep>
I do not see, however, how a MUA can realiably determine which edgeHeaders
are real, and which are faked by the spammer, unless the message was
digitally signed. Or there were always, say, 3 internal MTAs that you know
incoming mail will pass through (in which case it just a matter of finding
the edge).
- Mark
System Administrator Asarian-host.org
---
"If you were supposed to understand it,
we wouldn't call it code." - FedEx