Okay so I'm back on the confuzer with a proper

Question

Okay so I'm back on the confuzer with a proper

keyboard and not a piece of glass. Ready? This is gonna be a long one.

So first off it should be noted that SMTP itself doesn't deserve all the blame, the protocol itself is actually very simple (and aptly that's what the S stands for). It's really easy to send a basic email over netcat and postmasters may want to do that sometimes for troubleshooting. You just tell the other mail server who you are (hello, this is my domain), where you're sending from and who you're sending to (that destination mailbox is allowed, right?). And then comes the data which is practically a verbatim copy of what you'd export as a .eml file. Simple stuff.

Mail server software like Postfix and Dovecot just make it so overly and unnecessarily complicated. It's a great example of programming/design error - if your program can make a heuristic on what a particular configuration might be, it should. Postfix and Dovecot do the complete opposite and each have hundreds of configuration options that can all be misconfigured. And when they are misconfigured you have e.g. an open relay which essentially results in a raped mail server and a ton of spam.

An example in SMTP itself might be that the envelope's From: and To: headers do not have to be the same as the letter's. That's mainly for compatibility with bounces but causes a lot more problems than it solves. Sextortion emails, my mother recently told me about one she had and got her very worried. It appeared to be sent from her own email address (some local ISP mailbox) and of course coupled with how sextortions are generally very scary looking, she got scared. Who knows, maybe she was schlacking on some site. I don't ask. But that email seemingly being sent from her own email address is a problem with SMTP. The envelope's From: header can be completely legit and come from your mail server. The letter's From: header can be anything you want. The mail server only checks the former, the mail client only checks the latter. And therein lies the problem. Those should be verified by the mail server and the mail client to be the same. And that's only the tip of the iceberg...

0

29.04.2020

1 ответов

14 просмотров

Ender · Accepted Answer

Ender

Ah, one of those "research proper config first" programs :(

0

29.04.2020

Похожие чаты

Okay so I'm back on the confuzer with a proper

1 ответов

Похожие вопросы