Monday, March 06, 2006

Dissecting Email Headers, part III

Part III
Definitions and Glossary:

SMTP Simple Mail Transfer Protocol (RFC 822). For transmission of mail across the internet.
MIME Multipurpose Internet Mail Extensions, is an Internet standard specifying message formats for transmissionof different types of data by electronic mail.

SPF technology was designed to make the sending of spam/virus messages with faked domain names more difficult. It is like "reverse MX" DNS record which identifies a domain name with a server from which this domain sends itsmessages.

Message ID The unique id every email is provided by the receiving MTA. On Unix systems, usually based on Unix Time.

MTA Mail Transport/Transfer Agent (SMTP) Mail routing, relaying.

Ok, so you found the X-Originating-IP. Now what?
Well, if you are curious, you can traceroute the ip address and check the route each packet takes from
the sending email system to the receiving email system. You can do a whois on the ip address to see how owns that particular ip address range. Or if it is an abuse case, you can copy the header an mail it to the senders mail domain for a complaint. The complaint/abuse address should be abuse@domain.com. If this
address bounces, try postmaster@domain.com.

Remember, if the mail is of the abuse character, you should be aware of that the X-originating ip address most likely is faked/spoofed.

No comments: