Subject: Spam catcher

From: Howard Hong <[email-masked]>
Date: Fri, 22 Apr 2016 09:44:55 +0000 (UTC)

Hello,
Would it help to stop spam by recording the IP address of the originating server when open SMTP relays collect mail? Record the IP address in the body of the e-mail, and record an IP address at each hop. Establish a chain of custody so I can track an e-mail back to the source IP address.
Thanks,Howard Hong

---

From: Dave Cridland <[email-masked]>
Date: Fri, 22 Apr 2016 11:45:09 +0100

Howard,

It would, and does, to some degree - the trace header fields (particularly
Received) specify exactly this in RFC 5321 and RFC 5322. The problem is
that these can be faked by various means.

DKIM extends this to provide cryptographic proof of the chain of custody,
too.

So while one cannot find the originating IP address, one can find the last
known good server in the presented custody chain with some effort and
reasonable reliability. This doesn't stop spam in its tracks, of course,
but as you note it does help.

Dave.

On 22 April 2016 at 10:44, Howard Hong <[email-masked]> wrote:

> Hello,
>
> Would it help to stop spam by recording the IP address of the originating
> server when open SMTP relays collect mail? Record the IP address in the
> body of the e-mail, and record an IP address at each hop. Establish a chain
> of custody so I can track an e-mail back to the source IP address.
>
> Thanks,
> Howard Hong
>

---

From: "John Levine" <[email-masked]>
Date: 22 Apr 2016 16:38:22 -0000

>Would it help to stop spam by recording the IP address of the originating server when open SMTP relays collect mail? Record
>the IP address in the body of the e-mail, and record an IP address at each hop. Establish a chain of custody so I can track
>an e-mail back to the source IP address.

Short answer: no.

Open SMTP relays disappeared a decade ago when spammers started
abusing them, and SMTP servers have always recorded the incoming IP
addresss in Received headers.

As someone else noted, once you get more than one hop, you have no
reason to believe the Received headers unless you know the relaying
host is reliable (in which case it's unlikely to have a spam problem.)

DKIM offers some help in identifying the originating, or at least the
signing server.  ARC is a work in progress to try to provide a signed
chain of DKIM like headers.

In my experience, other than a few narrow cases related to mailing
lists, trying to filter based on IPs beyond the immediately connecting
host isn't very effective.  The same IP could have a legit user
sending real mail and a botnet sending spam.

R's,
John

---

From: "Niels Dettenbach (Syndicat.com)" <[email-masked]>
Date: Fri, 22 Apr 2016 22:07:14 +0200

> Am 22.04.2016 um 18:38 schrieb John Levine <[email-masked]>:
> 
> abusing them

This is nearly two decades the case (even if every days starts misconfigured - usually not really usuable - relays until today.)…

best regards,

Niels.
—
Niels Dettenbach.
Syndicat IT & Internet
http.//www.syndicat.com