[Asrg] Re: draft-duan-smtp-receiver-driven-00.txt

[David hagel <david.hagel at gmail.com>]

On 5/10/05, John C Klensin <john+smtp at jck.com> wrote:
>
> Unless you abandon mail relaying, and perhaps even if you do,
> domain names and IP addresses are as easily spoofed as full
> email addresses.  The spammers figured both out many years ago.
>

you're mistaken. udp spoofing is easy BUT smtp uses tcp.
its almost impossible to spoof tcp sessions now.
spoofer needs to correctly guess the randomly generated sequence/ack
numbers. even if you magically do this, you gotta control ALL
intermediate routers or else smtp server's responses will be misdirected.
meaning you cannot create a normal tcp session.
it's a common misconception that "ip spoofing"
can be used to hide your ip address while surfing the net,
chatting on-line, sending e-mail, and so forth.
this is not true unless you're on the same subnet as victim
where you can sniff their tcp seq. #'s.
if whay you say is true, all DNSBLs would stop working dude.

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg