>What is X-RCPT-TO? Should this be possible on Imail? How can I secure my
>server against this?
That's kind of like a telemarketer calling you and telling you what your
telephone number is, and then asking the phone company why there are phone
numbers. You'll see why in a second.
When an E-mail is sent to you, during the SMTP transaction, the remote mail
server obviously has to let your mail server know who the recipients
are. This is done with a "RCPT TO" command (it may look like "RCPT TO:
<[EMAIL PROTECTED]>"). IMail is good and record in the headers who
the E-mail was originally destined to, so that if you have lots of
forwarding and such going on, you can figure out where it originally came
from. It's also good for preventing mail loops. Only the recipient can
see this header, so there are no security issues.
>I have received one message from Earthlink that my machine is a possible
>spamming machine and that my
>server is on there black list for relay.
Then you *definitely* want to close the relay, unless you're willing to
offer free services to spammers while charging your customers (do you think
your customers will stay if they know you're giving out free services to
spammers?).
With IMail, you can just use the "Relay mail for Addresses" option on the
SMTP Security tab. List there all the "safe" IP addresses, and then anyone
coming from other addresses can use SMTP AUTH.
>What's the impact of that?
You can't get mail from Earthlink, and if you get on other lists (AOL won't
send to open relays, either), you won't get mail from those sources.
>I also noticed that even Ipswitch uses X-RCPT-TO.
Yes, they are smart.
>Received: from ABIES.ABIES.FR [195.101.203.161] by hirscharchitects.com with
>ESMTP
> (SMTPD32-5.05) id AA3520F02D8; Sun, 10 Jun 2001 17:44:21 -0400
The *only* reliable information from all the headers of this E-mail is that
the remote mail server is 195.101.203.161. It claimed to be
ABIES.ABIES.FR, but might not be (probably it is just an open relay, like
you!).
>Received: from 205.185.22.194 ([205.185.22.194]) by ABIES.ABIES.FR with
>Microsoft SMTPSVC(5.0.2195.1600);
> Sun, 10 Jun 2001 23:32:20 +0200
This *probably* means that the spammer came from 205.185.22.194. That's
only if ABIES.ABIES.FR is reliable.
>Message-ID: <000046c93e3a$00004ae6$0000347e@>
Bam. Declude would have caught this one with its BADHEADERS test! This is
an invalid header.
>X-RCPT-TO: <[EMAIL PROTECTED]>
This one just means that the E-mail was addressed to [EMAIL PROTECTED]
-Scott
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
