Request for Question Clarification by
maniac-ga
on
17 Apr 2006 18:49 PDT
Hello Mdmbud,
Could you explain more fully what you mean by
"the IP that shows it being sent is the domain it is sent from."?
I ask because there are some mail headers you can manipulate and
others are beyond your control.
There are several headers that include system names / IP addresses.
Using a piece of spam I have as an example, the headers are (sanitized
slightly):
Return-path: <chvx@globalfinance.nl>
Received: from mac.com (smtpin09-en2 [10.13.10.79])
by ms73.mac.com (iPlanet Messaging Server 5.2 HotFix 2.03 (built Nov 22 2004))
with ESMTP id <0IXH006QYWYBW0@ms73.mac.com> for aaaaaa@mac.com; Mon,
10 Apr 2006 00:32:35 -0700 (PDT)
[1 - above generated by ms73.mac.com, IP shown is of "mac.com"]
Received: from cpe-065-188-191-###.triad.res.rr.com
(cpe-065-188-191-###.triad.res.rr.com [65.188.191.###])
by mac.com (Xserve/smtpin09/MantshX 4.0) with SMTP id k3A7WRHq020048 for
<aaaaaa@mac.com>; Mon, 10 Apr 2006 00:32:32 -0700 (PDT)
[2 - above generated by "mac.com", IP shown is of the sending system]
Received: from rwzbx.awo ([65.188.25.###])
by cpe-065-188-191-###.triad.res.rr.com (8.13.3/8.13.3)
with SMTP id k3A7Zped048346; Mon, 10 Apr 2006 03:35:51 -0400
[3 - tentatively the originating site (but may be forged)]
Date: Mon, 10 Apr 2006 03:30:36 -0400
From: Sally Mclean <chvx@globalfinance.nl>
[4 - will be listed as "from" in most mail programs]
Subject: accessible
To: aaaaaa@mac.com
[5 - remainder deleted]
Which of the items (1-4) annotated above are you referring to? [or something else]
If #4, that should be a straight forward fix. This spam example shows
that (from says globalfinance.nl, the bottom received message says
rwzbx.awo) kind of behavior.
If #1 through #3, you can only control the records on the lines you
generate. For example, I "trust" #1 and #2 since they are generated by
mac.com systems. You won't be able to change those lines, and in
particular, can't revise the sending IP of #2.
Lines below that point (e.g., #3) can be manipulated, but that
manipulation will generally be considered "forgery" by the receiving
party.
--Maniac