[Asrg] SMTP pull anyone?

[Ravi shankar <ravisha22 at gmail.com>]

Hi,

 

Me and my buddy had a interesting discussion, which i thought could put across the geeks here.

 

It goes something like this:

 

SMTP is currently a push protocol and is initiated by the the sender, no controlling that fact.

 

But it is possible to overcome the relay problems, IP spoofing and domain impersonation etc,

 

by making the servers pull the mails.

 

1. Sending server contacts the destination and proovides the Message ID and sender details(and other details) and disconnects the session.

 

2. The receiving server queues it up and looks up the messages one by one using DNS to determine their legitimacy.

 

3. If the IP that contacted is legitimate(can be verified by say SPF?), it contacts the sender and provides the message ID with other details.

 

4. The sending server then hands over the message.

 

5. To overcome DDoS attacks, the receiving server can be made to request the next 10 or so Message IDs that it will assign to messages,

 

so that if a attacker tries to give those details, it will know from the next list of message IDs that it's fake connection.

 

6. May be by this collection of data, the IP addresses can be reported to a RBL and blacklisted.

 

Please point the holes in this model, so that we might get a entirely new insight.

 

Note: I have gone trough IM2000 and other similar discussions in the archive. Just thought this version of C/R is worth getting discussed.

 

Regards,

Ravi