Many thanks for the informative response. Is there a place that I can find a tutorial about this stuff?
Helder Correia wrote: <stuff deleted> >>Received: from bigfoot.com (mail.bigfoot.com [64.15.239.142]) by >>bm4.mail.tds.net (8.12.3/8.12.2) with SMTP id g9Q1ROtS013350 for >><[EMAIL PROTECTED]>; Fri, 25 Oct 2002 20:27:24 -0500 (CDT) > >Your ISP's SMTP server claims that it received the message from >something claiming to be "bigfoot.com". Your SMTP server determined >that the IP address of the sender was "64.15.239.142" and looked up the >official name of this address in its DNS records. The official name in >the DNS records was "mail.bigfoot.com", so the sender identified itself >honestly. Trust this header. > >>Received: from cnn.com ([200.13.230.243]) by BFLITEMAIL1A.bigfoot.com >>(LiteMail v3.02(BFLITEMAIL1A)) with SMTP id >>25Oct2002_BFLITEMAIL1A_53019_5225563; Fri, 25 Oct 2002 21:27:22 -0400 EST > >Bigfoot's SMTP server claims that it received the message from >something claiming to be "cnn.com". Your SMTP server determined that >the IP address of the sender was "200.13.230.243", but either didn't >look up the address in its DNS records or *did* look it up but didn't >find any matching records. Since you regularly receive forwarded email >from BIGFOOT.COM, you'll have to determine for yourself whether BIGFOOT >does or does not typically perform reverse-DNS lookups. Um, was it my ISP's SMTP server, or Bigfoot's, that determined that the sender was 200.13.230.243? I would've assumed that this entire portion of the header was provided by Bigfoot's SMTP server. Roger Diggle Even when the experts all agree, they may well be mistaken. -- Bertrand Russell ___________________________________________________________________________ To unsubscribe send a mail message with a SUBJECT line of "unsubscribe" to <[EMAIL PROTECTED]> or <[EMAIL PROTECTED]>

