Re: [Declude.JunkMail] Weird Internet Headers

[R. Scott Perry]

What I don't understand is how the mail is getting to my server
(mail.parallax.ws)...

Received: from parallax.ws (mail.parallax.ws [12.161.104.4]) by
scotty.rp-l.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21)
id VT8738AL; Thu, 31 Oct 2002 14:59:34 -0500

The recipient received the E-mail from Exchange, that received the E-mail from your mailserver.

Received: from dustpuppy [194.151.108.80] by parallax.ws with ESMTP
  (SMTPD32-7.13) id ABB0446D010E; Thu, 31 Oct 2002 14:59:44 -0500

Your mailserver received the E-mail from 194.151.108.80 (which claims to be a host called "dustpuppy", which isn't valid, and would cause the HELOBOGUS test to fail).

Received: from cerberus.hollandcolours.com (cerberus.hollandcolours.com [194.151.108.67])
by dustpuppy (8.11.3/8.11.3) with ESMTP id g9VLm4Q31395;
Thu, 31 Oct 2002 22:48:04 +0100 (CET)

"dustpuppy" supposedly received the E-mail from 194.151.108.67, which claims to be cerberus.hollandcolours.com (but, as we know, that can easily be forged just as dustpuppy did).

The key is that the Received: headers are in the order that the message was sent through, with the most recent mailserver at the top.
-Scott

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.