Re: [vps-mail] How to block missuse of local msessage id

[Scott Wiersdorf <scott@xxxxxxxxxxxx>]

On Mon, Dec 22, 2003 at 06:28:22PM +0100, Godwin Stewart wrote:
> Mon, 22 Dec 2003 10:13:25 -0700 scripsit Scott Wiersdorf:
> 
> > This means that _any_ field in the message itself (headers, body--the
> > whole ball of wax) cannot be trusted.
> 
> Except the final (top-most) "Received:" header and any "Return-Path:" header
> above it since they are inserted by the final, receiving MTA. You do trust
> your own MTA, right? :)

Yeh, I was going to mention that after I sent my reply. That top
'Received' header will tell you the last relay in the chain before it
reached your mail server. Some of that information is untrustworthy
(most MTAs insert the connecting IP address and reverse-lookup of that
address, which is fairly trustworthy, but any "hops" before that one
cannot be trusted at all).

Scott
-- 
Scott Wiersdorf
scott@xxxxxxxxxxxx
======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).