How it works?
You've probably noticed already that e-mail is a really surprising thing.
Its convenience is doubtless but it's not a reason to ignore such problems as SPAM, mail delivery failures, etc.
Let's have a closer look at these problems and then get back to the privacy and security ones ...
As a matter of fact, there're several independent processes involved in the sending and receiving e-mail:
1. You send the letter with your mailer (for example Outlook, Eudora, etc.) to the mail server of your ISP using SMTP
protocol (there're also direct mailers and we can skip the step two when using them).
2. The letter is relayed to the destination server set as a Mail eXchanger (MX in DNS) for the target domain.
3. Your addressee receives the letter from his ISP mail server via POP3 or IMAP protocol.
Note that this description is simplified. I doubt you came here to read how to install MHS-SMTP gateway
or something like this :) But if you want to send your mail directly and have no idea what SMTP server to set in your
mailer, I can give you a hint. Try to use "Whoiz" or MX service - they will show you preferred
mail server for given e-mail.
Generally speaking, problems can be occurred on any of above-mentioned stages. For example the server
you're sending mail to can reject your message with "No such user" or "Relaying denied" diagnosis. Anyway all
well-configured mail servers will add some headers to your message. These headers are not seen by default but if
you turn on "Show kludges" (or "View all headers", or the like) option in your mailer you'll probably see a set of
strings at the top of received letter. Concerning the privacy the most important headers are started with "Received:".
They can help us to find out who was the sender because "From:" field can be easily forged. For example your address is
you@mail.server and you see something like this:
Return-Path: <anny@china.com>
[multiple Received: skipped]
Received: from [63.198.41.10] (HELO mailsrv.china.com)
by my_mail_server (server_version) with SMTP
id 27126227 for you@mail.server; Mon, 17 Apr 2000 06:03:36 +0400
From: "Sign Up here" <anny@china.com>
To: <no1@noserver>
Subject: hi ! Want money??
If you want money click here !
This is a typical SPAM message. The last "Received:" line points to the source of SPAM. Note that there's
no valid address in "To:" field. That doesn't mean you've received the message addressed to another person.
In this example your address has been specified in "Bcc:" (Blind Carbon Copy) field but you can see that
mail server still has the real destination address in the "Received:" field (this is not always true though).
Let's parse "Received:" string. We see that the message was probably sent by mailsrv.china.com - it was
set in HELO command. The domain matches the one in "From:" field but we still need to check the IP.
The address 63.198.41.10 can be resolved into name with nslookup program but sometimes you can get IP that
has no DNS record. So I highly recommend you to use "Whoiz" engine
- it's really easy and efficient way to get a lot of information about any IP in
seconds. In this case we can get adsl...pacbell.net as a hostname.
So the mailsrv.china.com is fake and we can forward this SPAM to the contact address for SBCIS58360 network and/or
to the abuse service of pbi.net. Talking about privacy remember that your own letters can be also traced back ...


|