Please, explain, what does it mean? "Yours will add a Received: header, and leave mine in tact."
You were saying Received: headers are hard to forge. I was trying to explain that while it is impossible to forge the Received: header that *your* mailserver adds, it is very easy to forge any other Received: headers (or any other header). In fact, there is at least one major spammer that is forging Declude JunkMail headers.
As I understand this process in Imail example:
to connect any server you need to create first D*.SMD and Q*.SMD files.
Lets say for example that I want to forge the header and send my mail from my server1 throught your server2 to other server3. First of all I modify the D file and insert in the first line something familiar:
Received: from list.microsoft.com [666.666.666.666] by zombie.com with ESMTP (SMTPD32-8.05) id AC37F47500BC; Fri, 06 Aug 2004 18:40:23 +0600
Then I try to connect to server2 to deliver this letter.
Correct.
You server accept the connection. And now i _can't_ modify anything in this D file, Your server just download the copy of this D file and then insert this legal line:
Received: from _NORMALHELO_ [_NORMAL.IP_] by server2.com with ESMTP <-this is the open relay ip (SMTPD32-8.05) id AC37F47500BC; Fri, 06 Aug 2004 18:40:23 +0600 Received: from list.microsoft.com [666.666.666.666] by server1.zombie.com with ESMTP (SMTPD32-8.05) id AC37F47500BC; Fri, 06 Aug 2004 18:40:23 +0600 ...and forward mail to server3, then server3 insert next legal string
Your mean that you can modify the first line from server1?
No. It is impossible to modify that top Received: header (the one added by your IMail server), although you can give them any HELO/EHLO you want. Any other header besides the top Received: header (or other headers added by your mailserver at the bottom) can be forged.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
