[exim] Re: bounce messages and their potential misuse

2006-04-03 Thread Adam Funk
On 2006-04-03, Marc Sherman <[EMAIL PROTECTED]> wrote: > Adam Funk wrote: >> >> That provider adds header to every message with its abuse@ address and >> my (authenticated) userid for its service. That should be good >> enough. > > If it doesn't prevent you from spoofing someone else's return add

Re: [exim] Re: bounce messages and their potential misuse

2006-04-03 Thread Marc Sherman
Adam Funk wrote: > > That provider adds header to every message with its abuse@ address and > my (authenticated) userid for its service. That should be good > enough. If it doesn't prevent you from spoofing someone else's return address and thus spamming them with bounces, it isn't. - Marc --

[exim] Re: bounce messages and their potential misuse

2006-04-03 Thread Adam Funk
On 2006-04-01, Marc Sherman <[EMAIL PROTECTED]> wrote: > The behaviour you've just described is called "Sender Address Forgery". > You happen to be forging your own work address, which you do > legitimately control, but your ISP has no way of knowing that fact, and > by rights should be blocking

Re: [exim] Re: bounce messages and their potential misuse

2006-04-01 Thread Marc Sherman
Adam Funk wrote: > > As I understand it, the MAIL FROM address is what ends up in the > Sender: header and is where bounces go, right? So I'd rather not have > my mailhub modifying it. When I send an e-mail from home with my work > address in the From: header, for example, I want any bounces to

[exim] Re: bounce messages and their potential misuse

2006-04-01 Thread Adam Funk
On 2006-04-01, W B Hacker <[EMAIL PROTECTED]> wrote: >> I've already been forced to pay for an outbound mail service because >> of RBL hell and my ISP's irresponsibility for providing outgoing SMTP. >> >> > > "RBL hell" is generally *earned* when one sets up an MTA w/o > fixed IP and proper DNS

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread W B Hacker
Adam Funk wrote: On 2006-03-31, W B Hacker <[EMAIL PROTECTED]> wrote: *trim* If you weren't running a 'home Exim' at all, but simply had multiple accounts set up in your MUA, each account would seek to > I've also got mail coming from cron jobs, logcheck and scripts, all of which expect

[exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Adam Funk
On 2006-03-31, Peter Bowyer <[EMAIL PROTECTED]> wrote: >> To do that I'd have to configure my home Exim to route mail >> differently according to the From-address, > > Trivial in Exim - very many 'home users' of Exim do this. I know, but it was the next part that bugged me. >> and I'd have to st

[exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Adam Funk
On 2006-03-31, W B Hacker <[EMAIL PROTECTED]> wrote: >> To do that I'd have to configure my home Exim to route mail >> differently according to the From-address, > If you weren't running a 'home Exim' at all, but simply had > multiple accounts set up in your MUA, each account would seek to > c

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread W B Hacker
Adam Funk wrote: On 2006-03-31, Steve Hill <[EMAIL PROTECTED]> wrote: I think you should be sending your mail via your work's authenticated SMTP relay (and yes, I'm aware they probably don't run one :). This is a requirement anyway if your work published SPF records for the domain. To do

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread John W. Baxter
On 3/31/06 1:32 AM, "Jeremy Harris" <[EMAIL PROTECTED]> wrote: > With auth, yes, accept-then-bounce is permissable (but still > suboptimal, I think. I prefer, as a user, an instant error > to my mistyping a destination address. As a networking engineer > I prefer the fewer number of connections)

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Peter Bowyer
On 31/03/06, Adam Funk <[EMAIL PROTECTED]> wrote: > On 2006-03-31, Steve Hill <[EMAIL PROTECTED]> wrote: > > > I think you should be sending your mail via your work's authenticated SMTP > > relay (and yes, I'm aware they probably don't run one :). This is a > > requirement anyway if your work publ

[exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Adam Funk
On 2006-03-31, Steve Hill <[EMAIL PROTECTED]> wrote: > I think you should be sending your mail via your work's authenticated SMTP > relay (and yes, I'm aware they probably don't run one :). This is a > requirement anyway if your work published SPF records for the domain. To do that I'd have to

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Steve Hill
On Fri, 31 Mar 2006, Adam Funk wrote: As I understand it, the MAIL FROM address is what ends up in the Sender: header and is where bounces go, right? So I'd rather not have my mailhub modifying it. When I send an e-mail from home with my work address in the From: header, for example, I want an

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Gururajan Ramachandran
Hello, Would anyone know of any sample config files or examples in the docs that show how to properly implement this? My setup is a smarthost that sends to another machine with the users in it. Both run the Exim email server. Thanks, Guru __ Do

[exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Adam Funk
On 2006-03-31, Marc Sherman <[EMAIL PROTECTED]> wrote: >> Now when we say "senders' addresses", which headers are we talking >> about? For example, I send mails from my home computer with various >> from-addresses (mainly one for work and one for personal stuff), none >> of which is associated wi

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Marc Sherman
Adam Funk wrote: > > Now when we say "senders' addresses", which headers are we talking > about? For example, I send mails from my home computer with various > from-addresses (mainly one for work and one for personal stuff), none > of which is associated with my ISP. Either MAIL FROM, verified o

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Ian Eiloart
--On 31 March 2006 10:32:24 +0100 Jeremy Harris <[EMAIL PROTECTED]> wrote: With auth, yes, accept-then-bounce is permissable (but still suboptimal, I think. I prefer, as a user, an instant error to my mistyping a destination address. As a networking engineer I prefer the fewer number of con

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Peter Bowyer
On 31/03/06, Jeremy Harris <[EMAIL PROTECTED]> wrote: > Peter Bowyer wrote: > >>>We're talking about an outbound relay sending to arbitrary > >>>destinations, with verified senders. Callouts are a waste of time, > >>>because it can deliver a bounce to the known sender if it's unable to > >>>deliver

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Jeremy Harris
Peter Bowyer wrote: We're talking about an outbound relay sending to arbitrary destinations, with verified senders. Callouts are a waste of time, because it can deliver a bounce to the known sender if it's unable to deliver a message. Which known sender would this be? The one which it authen

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Peter Bowyer
On 31/03/06, Jeremy Harris <[EMAIL PROTECTED]> wrote: > Peter Bowyer wrote: > >>I disagree. It should. > > > > > > We're talking about an outbound relay sending to arbitrary > > destinations, with verified senders. Callouts are a waste of time, > > because it can deliver a bounce to the known send

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Jeremy Harris
Peter Bowyer wrote: I disagree. It should. We're talking about an outbound relay sending to arbitrary destinations, with verified senders. Callouts are a waste of time, because it can deliver a bounce to the known sender if it's unable to deliver a message. Which known sender would this be?

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Peter Bowyer
On 31/03/06, Jeremy Harris <[EMAIL PROTECTED]> wrote: > Peter Bowyer wrote: > > On 30/03/06, Adam Funk <[EMAIL PROTECTED]> wrote: > >>I'm thinking of MTA(n-1) as a department's outgoinggmailhub or ISP's > >>smarthost. It's usually configured to accept anything from within the > >>IP range it's sup

Re: [exim] Re: bounce messages and their potential misuse

2006-03-31 Thread Jeremy Harris
Peter Bowyer wrote: On 30/03/06, Adam Funk <[EMAIL PROTECTED]> wrote: I'm thinking of MTA(n-1) as a department's outgoinggmailhub or ISP's smarthost. It's usually configured to accept anything from within the IP range it's supposed to cover, That part it what it shouldn't do. By all means re

Re: [exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Peter Bowyer
On 30/03/06, Adam Funk <[EMAIL PROTECTED]> wrote: > On 2006-03-30, Peter Bowyer <[EMAIL PROTECTED]> wrote: > > > You're right, it wouldn't use callouts. But instead, it has a closed > > community of known senders for whom it relays, and it can safely > > assume that none of them is forging its send

[exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Adam Funk
On 2006-03-30, Peter Bowyer <[EMAIL PROTECTED]> wrote: > You're right, it wouldn't use callouts. But instead, it has a closed > community of known senders for whom it relays, and it can safely > assume that none of them is forging its sender address - so if it gets > a rejection on a relayed messa

Re: [exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Peter Bowyer
On 30/03/06, Adam Funk <[EMAIL PROTECTED]> wrote: > On 2006-03-30, Peter Bowyer <[EMAIL PROTECTED]> wrote: > > >> >> But when MTA(n) rejects a message that MTA(n-1) is trying to relay, > >> >> MTA(n-1) has to bounce it, right? > >> > > >> > MTA(n-1) shouldn't accept messages to invalid recipients i

Re: [exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Ian Eiloart
--On 30 March 2006 17:18:21 +0100 Steve Hill <[EMAIL PROTECTED]> wrote: On Thu, 30 Mar 2006, Adam Funk wrote: I'm thinking of MTA(n-1) as a department's outgoinggmailhub or ISP's smarthost. It's usually configured to accept anything from within the IP range it's supposed to cover, and use D

Re: [exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Ian Eiloart
--On 30 March 2006 16:49:11 +0100 Adam Funk <[EMAIL PROTECTED]> wrote: I'm thinking of MTA(n-1) as a department's outgoinggmailhub or ISP's smarthost. It's usually configured to accept anything from within the IP range it's supposed to cover, and use DNS MX to pick MTA(n) for non-local recip

Re: [exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Ian Eiloart
--On 30 March 2006 16:16:09 +0100 Adam Funk <[EMAIL PROTECTED]> wrote: On 2006-03-30, Peter Bowyer <[EMAIL PROTECTED]> wrote: On 30/03/06, Adam Funk <[EMAIL PROTECTED]> wrote: On 2006-03-30, Nigel Wade <[EMAIL PROTECTED]> wrote: > That only works for mis-configured MTAs. A properly configur

Re: [exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Steve Hill
On Thu, 30 Mar 2006, Adam Funk wrote: I'm thinking of MTA(n-1) as a department's outgoinggmailhub or ISP's smarthost. It's usually configured to accept anything from within the IP range it's supposed to cover, and use DNS MX to pick MTA(n) for non-local recipients. It's also worth considering

[exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Adam Funk
On 2006-03-30, Peter Bowyer <[EMAIL PROTECTED]> wrote: >> >> But when MTA(n) rejects a message that MTA(n-1) is trying to relay, >> >> MTA(n-1) has to bounce it, right? >> > >> > MTA(n-1) shouldn't accept messages to invalid recipients in the first >> > place. If it has no direct knowledge of vali

Re: [exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Peter Bowyer
On 30/03/06, Adam Funk <[EMAIL PROTECTED]> wrote: > On 2006-03-30, Peter Bowyer <[EMAIL PROTECTED]> wrote: > > On 30/03/06, Adam Funk <[EMAIL PROTECTED]> wrote: > >> On 2006-03-30, Nigel Wade <[EMAIL PROTECTED]> wrote: > >> > >> > That only works for mis-configured MTAs. A properly configured MTA w

[exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Adam Funk
On 2006-03-30, Peter Bowyer <[EMAIL PROTECTED]> wrote: > On 30/03/06, Adam Funk <[EMAIL PROTECTED]> wrote: >> On 2006-03-30, Nigel Wade <[EMAIL PROTECTED]> wrote: >> >> > That only works for mis-configured MTAs. A properly configured MTA would >> > reject >> > a message destined for a non-existent

Re: [exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Peter Bowyer
On 30/03/06, Adam Funk <[EMAIL PROTECTED]> wrote: > On 2006-03-30, Nigel Wade <[EMAIL PROTECTED]> wrote: > > > That only works for mis-configured MTAs. A properly configured MTA would > > reject > > a message destined for a non-existent recipient. It would not accept it and > > then > > generate

Re: [exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Jeremy Harris
Adam Funk wrote: But when MTA(n) rejects a message that MTA(n-1) is trying to relay, MTA(n-1) has to bounce it, right? Which in turn is why MTA(n-1) should be doing recipient-verify callouts. -Jeremy -- ## List details at http://www.exim.org/mailman/listinfo/exim-users ## Exim details at http

[exim] Re: bounce messages and their potential misuse

2006-03-30 Thread Adam Funk
On 2006-03-30, Nigel Wade <[EMAIL PROTECTED]> wrote: > That only works for mis-configured MTAs. A properly configured MTA would > reject > a message destined for a non-existent recipient. It would not accept it and > then > generate a bounce message. But when MTA(n) rejects a message that MTA