[CentOS] dealing with spoofing

Wed Aug 31 20:29:33 UTC 2011
Josh Miller <joshua at itsecureadmin.com>

On 08/31/2011 01:27 PM, m.roth at 5-cent.us wrote:
> Stephen Harris wrote:
>>> Here's a thought I just thunk, folks: some scum, apparently in eastern
>>> Europe, has harvested my email, and is using it in the Reply-To: in its
>>> spamming efforts. Now, I realize that some mails go out from noreply,
>>> but
>>> other than that, is there a good reason why a mailserver would not be
>>> configured to send delivery failure to *both* Reply-To and From?
>>
>> You don't want to send rejects to more than one address 'cos you then
>> have a simple message multiplier; send one message, generate two bounces;
>> the mail server will be doubling the back-scatter problem!
>>
>> Anyway, the SMTP server should send the delivery failure to the envelope
>> address, which may be different to both the From and Reply-To addresses.
>>
> That would be lovely. Unfortunately, a high percentage seem to use the
> Reply-To address. Trust me, the last four or five months, I've gotten
> probably hundreds, if not more, of delivery failures. And I wind up at
> least glancing at them, in case email to this list, or to a friend, has
> bounced.

Mark,

The Reply-To address is an optional component of the email header and is 
not used in email routing by mail servers.

If the Reply-To is absent, mail clients compose a message to be sent to 
the sender listed in the From field instead.

Mail server will send NDRs (non-delivery receipts) back to the envelope 
sender every time with no regard for From or Reply-To.


-- 
Josh Miller
Open Source Solutions Architect
http://itsecureadmin.com/