Identifying the Source of Incoming SMTP Messages

The identtcp or identtcpnumeric channel keyword when placed on your xtcp_local channel, where x depends on just which sort of TCP/IP channel you're using, causes the IMTA to attempt an IDENT query on incoming SMTP connections. If the sending system is running an IDENT server, it will return to the IMTA the SMTP sender's identity for the IMTA to insert in the Received: header the IMTA constructs. If the sending system is not running an IDENT server, the IMTA will just use the port number (port 25) and the sending system IP number or name.

With identtcpnumeric, the IMTA uses the IDENT information (if any) and the actual IP number of the sending system; with identtcp, the IMTA also attempts to translate the IP number to a system name by performing a DNS reverse lookup. Thus identtcpnumeric incurs slightly less overhead because it does not do the DNS reverse lookup, and the actual IP number may perhaps be considered somewhat more authoritative that the name resulting from a DNS query. However, using the system name as with identtcp may be considered more user-friendly.

Identifying information in Received: headers can assist in detecting spoofed e-mail and in holding the senders of such spoofed e-mail accountable. Note that user-friendly identifying information is a not insignificant feature: even a naive user may notice that a Received: header in a suspicious message contains an unexpected address, for example, anonymous@SpoofersAreUs.edu, but only a fairly sophisticated user is liable to pay attention to any IP numbers showing up in Received: headers. So a choice between these keywords may be affected by whether you are looking to provide forewarning to users that they may have received spoofed e-mail, or whether you merely wish to preserve the identifying information for use in investigating cases of spoofed e-mail.




Copyright © 1999 Sun Microsystems, Inc. All Rights Reserved.