Email Countersigns

[drewprops]

I am very tired of receiving bounceback emails from spammers who are spoofing using one of my domains. It occurred to me this morning that there must be a move afoot SOMEWHERE to introduce a countersigning system for ISPs. Essentially, if I send a legitimate email from my account a receipt is generated and kept on my ISP's server.

You would have to create an (opensource) receipt-checking system that could be incorporated into email clients, allowing them to poll the domain-holder's ISP's server to verify if the email is legitimate.

PLEASE tell me that there is something like this (or better) happening out there.

[thuh Freak]

most bounce backs i've gotten have a very similar format, and most have 'daemon' or 'sysadmin' in the From field. you could, in the email program of your preference, make a rool to push mail from 'daemon' or 'sysadmin' into a box just for bounce backs. periodically you could read through them to ensure that they are accurately bouncebacks.

i'm not totally familiar with smtp (which, i believe is the most common protocol for outgoing mail), but i'm pretty sure that some servers require user & pass to send mail, and some do not. and once they've verifed the user, some smtp servers do require the From address to be from their domain, usually matching the user/pas entered (aside from mail thats being relayed, which i'm pretty sure is handled specially).

unfortunately for us good people of the world, even if your theoretical solution was implemented, it wouldn't be in the spammers' interest to use such a client/plugin. and if it were implemented at the server level, then most servers would use it, but spammers dont sendout from those servers, they go to the sketchy ones with lax security. maybe i'm just being a pessimist, or not understanding your idea.

[LoCash]

Just a heads up, but when you receive any email from AppleNova, it comes from "sysadmin" :)

[drewprops]

I don't think that I was clear with this idea....

I already have a rule to strip out bouncebacks, what I'm talking about is something more...a way to stop spoofed spam from EVER reaching your email box.

To better explain I'll make up an example...

Let's say that a trusted internet security organization creates a new opensource email sub-protocol called "Valid Receipt". For the sake of this example lets pretend that the big ISPs install this system on their email servers and that the makers of major email applications implement "Valid Receipt" into their latest versions.

ALL of the validation happens at the server level.

Now, let's say that LoCash wants to send Murbot an email and that both of their ISPs have implemented Valid Receipt. When LoCash sends his message his ISP notes the message and writes a marker code to file before passing the message along to the destination address.

When messages arrive in users' inboxes, the receiving ISP's mail server tosses the authentication marker codes (assigned to those messages) back to the sending ISP's mail servers for a valid countersign that the email really did originate from that ISP.

Spammers could spoof emails from "applenova.com" all day long, but if an ISP's mail servers do not receive confirmation receipts from applenova's mail servers those messages are killed in-flight.

People whose ISPs joined this system could even apply a "confirmed valid" codification to the email.

Did this help explain it better? What do I NOT understand about email servers (likely to be a LOT).

[thuh Freak]

[trim]
yea, thats a better explanation. different than i was thinking. i like the idea. i really like that idea. i keep thinking about it, and coming up wiith potential problems or difficulties. then i come up with fixes for them. time to start lobbying the email server programmers of the world.

[drewprops]

Thank Freak, I hope that other people understand what I'm saying here...it seems so damned simple, conceptually anyway.


Edit: I cross-posted this over on AI and then realized it had LoCash's name and "applenova" in the description and busted ass to scan through and change names/domains to keep from getting a boot up the bunghole....a terrifying two minute ride I can tell you!