Date: Thu, 24 Jul 1997 16:31:16 -0700 (MST) From: Terry Lambert <terry@lambert.org> To: Anthony.Kimball@East.Sun.COM Cc: jas@flyingfox.com, terry@lambert.org, current@FreeBSD.ORG Subject: Re: (over)zealous mail bouncing Message-ID: <199707242331.QAA18538@phaeton.artisoft.com> In-Reply-To: <199707242253.RAA01999@compound.east.sun.com> from "Tony Kimball" at Jul 24, 97 05:53:44 pm
next in thread | previous in thread | raw e-mail | index | archive | help
> : Seems like it would be nice for those implementing such a policy to > : allow chopping of subdomain prefixes; e.g., if getpeername/gethostbyaddr > : return foo.bar.acme.com, and the envelope sender is joebob@acme.com, > : then it's OK. Or is that too loose? > > And multiple names. MAIL FROM: jimbob@client.domain.com will often > come from isp.domain.net. And non-Internet paths. > > What about networks that do not use symbolic host names? In both these cases, you must use a "smarter host" that explicitly allows your mail. There are two types of filtering wich occur at a smarter host: 1) Relay filtering Given your getpeername/gethostbyaddr[/gethostbyname] on initial connection to validate you are not a SPAMmer, and filtering on "HELO domain" and "MAIL FROM:<user@domain>" for the same reason, the "RCPT TO:<username@other.domain>" is checked to see if it is a local address, or one which must be forwarded. If it must be forwarded, only allowed source hosts are permitted to forward. For ISP's, this boils down to an IP address in the range of IP addresses that the ISP dynamically or statically assigns to their customers who pay for relay services. The intent is to prevent the relay of SPAM by a SPAMmer through your machine, making you the target of mailbombs, etc., by upset users (also denial of service for your legitimate customers, etc.). 2) Local address filtering Given the same verified source and address information, you determine if you want to accept the mail for a local user. This allows you to comply with court orders against ISP participation in ISP client harrasment by an outside person or agent. You may not want to prevent the outside agent from sending mail *through* your system, only *to* it. Regards, Terry Lambert terry@lambert.org --- Any opinions in this posting are my own and not those of my present or previous employers.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199707242331.QAA18538>