WEBMAIL
from mail.bbxent.com (bbxent.com [209.164.18.214] (may be forged)) by bbxent..com (8.13.4/8.13.4) with ESMTP id k7V8u5Hf056062 for <fil*****@yahoo.com>; Thu, 31 Aug 2006 01:56:05 -0700 (PDT) (envelope-from brandon@bbxent.com)
OUTLOOK
from digmasterszLAP (temecula-cuda1-70-37-35-214.ontrca.adelphia.net [70.37.35.214]) by bbxent..com (8.13.4/8.13.4) with ESMTP id k7V8TDak055942; Thu, 31 Aug 2006 01:29:13 -0700 (PDT) (envelope-from b****@bbxent.com)
The part I am concerned with is the '(may be forged)' part in the webmail "Recieved" line in the header. Is that normal? The setup is courier-imap, sendmail, and squirrelmail.
>TaoWine wrote:
>Here the (may be forged) is the important part: it means that the DNS data for the host is >inconsistent, and hence the name is not used for the relaying check but only the IP number. If the >host name would be used, it would be simple to circumvent basic anti-relaying checks because the >PTR records might be under the control of an attacker, so he can chose any name he wants for his >IP address. That is, he can select a name for which you allow relaying because that name is one >that you control (your domain name). However, the forward lookup will fail or give at least a >different IP address, hence the name is marked as (may be forged)
My response.
hmmnmm... Well I have both forward and reverse DNS setup on this mail server bbxent.com forward and reverses to 209.164.18.214
The only way someone can relay is they authenticate themselvs, the only way someone can relay is they if can spoof an ip of someone that was just logged in. Anyway, I use pop-before-smtp to achive this, it addes users IP's to a DB, I have altered the sendmail config to read this database, each ip is cycled out every 30min.
So that means the web mail or the mail server are still seutp wrong, cause it only screws up the webmail and not POP using outlook.