Imail has a features that checks if the sender email address
exists.. That means they connect with SMTP to the MX for the domain, they
send the MAIL FROM, and they send the RCPT TO, and if the server complains,
then they assume it is because the email does not exist.
That sounded great from a start
sender address verification is a great technique, but how it is implemented apparently varies a lot between MTA software. IMGate/postfix does it right. On some sites that I admin, forged senders is highest count reject reason. The weakness, easily resolved (with IMGate), is legit servers that break RFC and have no valid return path.
To stop other sender forgeries when the spammer is forging one of postfix's domains, postfix uses its local database of known recipients to reject SENDERS to known recipients. ie, the MAIL FROM: [EMAIL PROTECTED] and RCPT TO: [EMAIL PROTECTED] will be rejected because postfix sender_address_verification finds that joeblow is not in our list of known recipients.
Another nice feature, and simpler in fact would be to "validate" the sender server, so if the email is incoming (not from an authenticated local user), imail would make a search for the DNS of the domain, and if the server is in the list of MX, then fine, but if the server is not, then TAG/BOUNCE/DEL/WHATEVER....
spf, sender permitted from, takes care of this situation (but breaks forwarding).
Len
_____________________________________________________________________ http://MenAndMice.com/DNS-training : Denver; NYC; San Jose http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
