At 3/9/2000 04:24 PM -0800, Jon McMullin wrote:
><snip>
>I think to a creative spammer, they would be able to impersonate one of your
>local users
>and put in [EMAIL PROTECTED] and still get away with it.
</snip>
Yes, well, this is exactly the problem. Anybody can forge the From address, and
everybody does. There is no way this will get you out of, or keep you out of, ORBS or
any RBL.
There is only one way to truly prevent any unauthorized relay. Authenticate your SMTP
users. This goes for any mail server. There are a number of ways to do this, and one
could use any combo of the methods. Three methods I know of off-hand are:
1. Allow sending mail only for a local IP range.
2. Require Auth SMTP to send mail.
3. Require POP/IMAP before SMTP (ie. user has to log in to check their mail before
they can send any. The permission is based on the IP address used, and times out after
X amount of time). Unfortunately, IMail does not support this.
Basically, unless you can authenticate your SMTP users, you'll be open to unwanted
relay in some way or other. If there's any other way, I'd love to hear it.
Cheers,
-Max
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
