Len, Thanks for your prompt reply.
Let's say that I have an Imail server protected by Postini or IMGate. The Imail Server has a bunch of domains each one with its unique IP. The Imail Server only accepts SMTP connections from the Postini or IMGate host (or Local users). But (here is the flaw of this design) the Imail server has an IP which it uses to accept SMTP connections from anybody to relay email (using AUTH of course for not local users) The Postini hosts (I am not sure about IMGate) will need SMTP VRFY enabled in the Imail server in order to provide a better protection against harvest or dictionary attacks. The above design leaves a hole that spammers could take advantage to harvest addresses. That's my problem.--perhaps I should not worry about it. I think a better design will be to use a server (with a protection system in place) just to deal with outgoing email. Otherwise it would be better to implement a protection system in the Imail server itself (Imail native protection, Declude, etc) What do you think? Regards Mario Antonio ----- Original Message ----- From: "Len Conrad" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Friday, July 14, 2006 9:21 AM Subject: Re: [IMail Forum] Enabling SMTP VRFY > > >By enabling SMTP VRFY, am I opening the server to harvest or dictionary > >attacks? Is this really a risk? > > > >It seems that spammers just by issuing several RCPT TO: lines in a pipeline > >and looking at the replies can simulate the SMTP VRFY command. > > exactly. SMTP VRFY is no defense, but turn it off anyway. > > Len > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > --- > [This e-mail was scanned for viruses by our AntiVirus Protection System] > > --- [This e-mail was scanned for viruses by our AntiVirus Protection System] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
