Subject: [fwtk-users] Re: Smap Message: peer dropped connection

From: Ted Keller <[email-masked]>
Date: Sat, 24 Nov 2001 13:44:03 -0500 (EST)

Rick,

Finally started to analyze your patch.  You are right, our smap versions
have diverged significantly.

In looking at the verify-reverse functionality, it appear that you only
look for a valid dns entry - not that it came from the actual domain on
the from address.  Am I reading this correctly?  Do you see any need to
verify that it actually came from hotmail?  - ie - match the from domain
with the actual host domain?

Appreciate you comments.

ted keller

>
> First, "verify-reverse". Any "from" address that has a domain that matches
> one of these entries must be sent from a host with a reverse DNS matching
> that entry.
> For example, I have:
> smap:   verify-reverse msn.com yahoo.com hotmail.com aol.com lycos.com
> That means that anyone trying to send with "mail from: <[email-masked]>"
> must be sent from a host that's in the hotmail.com domain. This is a real
> spamkiller - 75% of the junk mail I get forges hotmail or yahoo.

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Paul Dunphy <[email-masked]>
Date: Mon, 26 Nov 2001 10:42:33 -0500

Ted,

I should probably let Rick answer this, but I'm using his patch and it does 
indeed check that each message that claims to be from one of the domains 
listed in the "verify-reverse" entry is in fact from that domain. Note the 
following code segment, which begins at line 2111 in my (slightly modified) 
smap.c file:

         if (InCheckList(domain,cfp,"verify-reverse")) {
                 /* Must have a valid reverse DNS */
                 if (strcmp(rladdr, "unknown") == 0) {
                         return (FromNoRDNS);
                 }
                 else if (strstr(rladdr, domain) == NULL) {
                         return(FromDNSSpoof);
                 }

The "strstr(rladdr, domain)" statement above checks to see that the domain 
specified in the From address is in fact contained in the "real" domain 
name that was obtained by reverse-DNS lookup, and returns FromDNSSpoof if 
it does not.

Incidentally, I had to modify this code slightly since I have msn.com 
listed in my verify-reverse line, but it seems that valid e-mail from 
msn.com users actually come from a hotmail.com server. Since a lot of 
spammers try to spoof msn.com in their From lines, I didn't want to remove 
msn.com from my verify-reverse list, so I hard-coded an additional check 
for this special case in the code. Maybe one day, in my spare time :), I'll 
create a more elegant solution.

Cheers...
Paul

P.S. Rick, thank you *very much* for this patch -- not only has it solved 
my "peer dropped connection" problem, but I am very happy with the amount 
of spam I am now able to reject. Good work!!

>with the actual host domain?

---------------------------------------------------------------------
Paul T. Dunphy, P.Eng.
Systems Administrator/Research Engineer
Centre for the Study of Commercial Activity
Ryerson University
Toronto, Ontario, CANADA

---

---

From: Rick Murphy <[email-masked]>
Date: Mon, 26 Nov 2001 20:13:36 -0500

At 10:42 AM 11/26/01 -0500, Paul Dunphy wrote:
>Ted,
>
>I should probably let Rick answer this, but I'm using his patch and it 
>does indeed check that each message that claims to be from one of the 
>domains listed in the "verify-reverse" entry is in fact from that domain. 
>Note the following code segment, which begins at line 2111 in my (slightly 
>modified) smap.c file:
>

Paul's got it right.

>for this special case in the code. Maybe one day, in my spare time :), 
>I'll create a more elegant solution.

A more consistent way to do that would be to allow an optional domain name 
(msn.com:hotmail.com for example); I'd change it to check "msn.com" from 
addresses for reverse domains in "msn.com" or "hotmail.com".

>of spam I am now able to reject. Good work!!

I've been very happy with the quantity of junk being rejected this way. 
I've had to add a few whitelist entries since doing this, but it's been 
very effective in spam killing.
         -Rick

---

---

From: Tony Gale <[email-masked]>
Date: 27 Nov 2001 09:38:41 +0000

> >name that was obtained by reverse-DNS lookup, and returns FromDNSSpoof if 

I haven't looked into the code, but am going from the description above.
I believe the "correct" way to do this check is to look up the MX record
for the envelope senders domain and check it against the address of the
sending system.

Using a reverse dns lookup is much more likely to fail and to give an
incorrect result.

-tony

---

---

From: Rick Murphy <[email-masked]>
Date: Wed, 28 Nov 2001 19:18:26 -0500

At 07:41 AM 11/28/01 -0700, Ken Long wrote:
>Ok, please allow me to show my ignorance here. Is the "envelope sender"
>the same as a custom "reply to" that I can set in my email client?

No, it's the address in the "MAIL FROM" transaction. Usually that's the 
"From:" address your recipient will see.

>I use Pegasus Email at home and have my smtp set to the ISP I'm connected
>to but my email identity and pop3 host are set to a different provider.
>This is because I've had the same email address since day 1 on the
>Internet and don't wish to change but switched over to cable modem
>service when it became available.

The reverse lookup check is *only* performed when the domain name of the 
sender matches a list. I verify hotmail, yahoo, and a few other commonly 
forged domains. It would be impractical to do this on a widespread basis. 
In fact, this mail is being sent from a host with no reverse DNS due to an 
incompetent ISP. I'd be blocked by my own code if you enabled 
verify-reverse on me. This is a big hammer that you need to use with 
discretion.
         -Rick

---

---

From: Tony Gale <[email-masked]>
Date: 28 Nov 2001 11:25:40 +0000

On Wed, 2001-11-28 at 00:35, Rick Murphy wrote:
> At 09:38 AM 11/27/01 +0000, Tony Gale wrote:
> For the big ISPs that is being used on, that's not the case. A big ISP's 
> outgoing SMTP servers aren't necessarily the same as their incoming servers 
> - but they're very likely to have a valid reverse lookup in their own domain.
> 
> All the patch does is to say that if you're trying to send mail with an 
> envelope sender of "[email-masked]", you *must* be coming from a host with a 
> valid reverse DNS somewhere in the yahoo.com domain. So far, that works 
> well for detecting the most common forged domains.

The contra-argument being that some ISPs don't allow you to establish a
reverse DNS for an IP range they have allocated to you.

So, it would be best to do both tests, and catch virtually everyone.

Thanks

-tony

---