Open Relay Checker before Opening MTA

[Matthew Hawkins]

On Mon, 11 Feb 2002, Alex Satrapa wrote:
> On Monday, February 11, 2002, at 10:22 , Matthew Hawkins wrote:
> 
> >Note that the internet standard says you MUST accept mail to the null
> >sender.  This is how bounces are sent.  BUT note that the null sender is
> >ALWAYS the *envelope* sender, and NEVER the *message header* sender (the
> >message header sender is usually changed to "MAILER-DAEMON" or sometimes
> >"postmaster")
> 
> I take it this means something like:
> 
> EHLO mail.example.com
> RCPT-TO:
> FROM: postmaster at mail.example.com
> DATA
> From: MAILER_DAEMON <postmaster at mail.example.com>
> To: Postmaster <postmaster at mail.blugle.com>
> 
> Is that what you're talking about?  (well... writing about I guess is 
> the technically correct term)

Remind me never to get you to write me an SMTP MTA :P

A real bounce will look like so (RFC1894):

--------------
EHLO mail.example.com
MAIL FROM: <>
RCPT TO: <lameuserwhocantgivemearealaddress at this.dom.ain>
DATA
From: postmaster <MAILER-DAEMON at example.com>
To: <lameuserwhocantgivemearealaddress at this.dom.ain>
Subject: Returned mail: you fucked up

Sorry, your message couldn't be delivered because you typoed the email
address, dummy!
.
QUIT
--------------

A fake bounce attempting to exploit well-intentioned, yet stupid mail
server administrators would be:

--------------
EHLO mail.example.com
MAIL FROM: <whogivesashit>
RCPT TO: <lameuser at this.dom.ain>
DATA
From: <>
To: <lameuser>
Subject: hahaha

Hahahaha make money fast, arsehole!

.
QUIT
--------------

-- 
Matt