Subject: smap and mail from:<>

From: "Ken Long" <[email-masked]>
Date: Tue, 30 May 2000 14:04:21 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

We're using sendmail behind smap on Linux.  I have the line 

  smap:           validate_sender 1

in my netperm-table.  Evidently this is causing smap to deny certain inter-
system status messages that are required by RFC, specifically, the 

  mail from:<> 

command which is used for certain bounce messages and return receipts.

Is there any good reason to have this config line active? Should I turn it 
off in order to be compliant?  What problems could I see if it were turned 
off?

Has anyone else received any complaints from mail administrators concerning 
this?  I received a rather nasty note from the admin at <hidden>.org.  After 
several emails back and forth he went off in a huff and blocked our domain!  
<grin>  Just can't take the pressure I guess.

Thanks in advance,
Ken Long

---

From: Ted Keller <[email-masked]>
Date: Tue, 30 May 2000 18:00:36 -0400 (EDT)

Ken,

One method people use to spam your site is to really lie about who they
are and use the mailer-daemon from address - hoping to bypass any spam
filtering you may have in place.  There are a number of sites on the
Internet which do NOT accept the mailer-daemon replies <> - and yes -
technically they are non-compliant.

Personnally, I always reply my mailerdaemons with a postmaster@ type of
mail address - and do accept the <> addresses in return.  I try to capture
the spammers through other means (spam lists and spam filters) that I've
included in the smap code.

Since this has been in place for a while at your site, I would probably
opt to keep it there and stand the heat for a while....

ted keller

---

From: Rick Murphy <[email-masked]>
Date: Tue, 30 May 2000 21:16:49 -0400

>technically they are non-compliant.

The *correct* solution is to allow "MAIL FROM:<>" messages to deliver to 
your domain only, not to relay anywhere else. Anyone that blocks from "<>" 
doesn't care about their users getting bounce messages, and is foisting 
them upon the postmaster of the domain generating the error message. 
They're broken.
Just my (strongly-held) :-) opinion.
         -Rick

---

From: "Ken Long" <[email-masked]>
Date: Wed, 31 May 2000 07:19:40 -0600

Ok, this makes sense.  Now, do you have any suggestions for allowing "mail 
from:<>" yet still keeping the spam protection that blocking non-verifyable 
from addresses provides?  Remember, our site is using sendmail behind smap.

I'm not ready to turn off validate_sender just to allow the mailer-daemon 
address in.  I suggested to the BOFH that complained to me that he should 
insert a verifyable from address then we would be happy to accept his mail.

BTW, section 5.3.3 of RFC 1123 spells out the requirements of using mail 
from:<> but it doesn't actually specify that I have to accept mail from this 
address.  A nit perhaps, but it does leave me an out.

Thanks,
Ken Long

---

From: Ted Keller <[email-masked]>
Date: Wed, 31 May 2000 13:23:31 -0400 (EDT)

Ken,

This is where you may have to do content scanning - deleting messages that
look like spam.

ted keller

---

From: "Ken Long" <[email-masked]>
Date: Wed, 31 May 2000 13:31:53 -0600

I did some source diving in smap.c (I'm not a C programmer) and found the 
section that returns the error message "bad from address" when the from 
address is null.  It would appear that this check is being done regardless of 
the validate_sender state (which is the very next section.)

(Line 536)
/* messages not originating locally must have a full sender */
   if (!from_host_local && !at)
                {
                printf("550 Bad From address\r\n");
                syslog(LLEV, "bad from address, %s, from %s/%s",
                       whofrom, hostnm, hostip);
                recip_clear();
                return 1;
                }

I'm about ready to ask our resident C guru to do some hacking on smap.c.  Has 
anyone done this particular mod before?  Would you care to share your 
experiences?

Thanks,
Ken Long