[Esa-l]Help with hybris getting thru filters

Joe Steele joe at madewell.com
Wed Jun 6 13:32:25 PDT 2001


As I understand things (someone can correct me if I'm wrong):

The return-path header is usually tacked on when final delivery 
is made.  It's created from the envelope sender address.

Chances are that "oemcomputer ([206.99.228.55])" used any empty 
envelope sender address which was translated by your sendmail 
configuration into MAILER-DAEMON at prometheus.motleypc.com.

Empty envelope sender addresses are typically used by servers 
when they must return undeliverable mail.  This prevents mail 
loops.

Messages can be sent without a Message-ID header.  In fact, I 
think you can pass a message to most SMTP servers without any 
headers at all.  Most servers (including yours) are configured 
to create certain headers (such as Message-ID and Date) if they 
are missing.  

In this case, "oemcomputer ([206.99.228.55])" didn't provide a 
message-id or a date header, so your server created them.

--Joe

-----Original Message-----
From:	Rick Thompson [SMTP:rthompson at motleypc.com]
Sent:	Wednesday, June 06, 2001 10:09 AM
To:	Angus Lees
Cc:	Email Security Announce list
Subject:	RE: [Esa-l]Help with hybris getting thru filters

Ok....things are becoming a little clearer.

The actual email header:

Return-Path: <MAILER-DAEMON at prometheus.motleypc.com>
Received: from oemcomputer ([206.99.228.55])
	by prometheus.motleypc.com (8.11.0/8.11.0/SuSE Linux 8.11.0-0.4) with SMTP
id f55CTwA07640
	for <gmcallister at motleypc.com>; Tue, 5 Jun 2001 08:29:58 -0400
Date: Tue, 5 Jun 2001 08:29:58 -0400
Message-Id: <200106051229.f55CTwA07640 at prometheus.motleypc.com>
From: Hahaha <hahaha at sexyfun.net>
Subject: Snowhite and the Seven Dwarfs - The REAL story!
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--VEVSXIB"
To: undisclosed-recipients:;
X-UIDL: fdefb34e8bfa370e00c24fc7e92ac0a7



Anybody with a guess as to thy the return-path is my own mail server?  The
mail message got an internal messageid which let it bypass the filter.  Why
didn't this get the messageid from the mailserver it originated from?



More information about the esd-l mailing list