Fred:
The ONLY header info you can trust is the one that your OWN mail server
inserted.
E.g., if your mail server inserted this "first" header:
Received: from scmp-m01.mail.aol.com [163.163.163.163] by
mail.fredsserver.com...
then you could trust the following:
- The connection to your mail server was made from IP address
163.163.163.163
- The machine connecting to you used a "HELO" string of
"scmp-m01.mail.aol.com"
- That the date/time shown is the time used on YOUR machine
You can NOT trust:
- that the machine truly IS "scmp-m01.mail.aol.com" because that
string is controlled by the SENDING machine, thus can be (and frequently is)
forged or at least wrong.
However, you can NOT trust any header claimed to have been inserted by any
server OTHER than your's, e.g.:
Received: from scmp-m01.mail.aol.com (scmp-m01.mail.aol.com
[172.20.75.169]) by omr-m01.mx.aol.com (v95.1) with ESMTP id
is made to look as if it was inserted by "omr-m01.mx.aol.com" - but since (I
assume) this is not YOUR machine, you can't (and should not) imply that any
of this information is valid. Indeed, the IP address used is in the IANA
reserved range and I doubt that AOL would/could use those ranges for
"external" mail servers.
That particular header line does look like a fake.
Best Regards
Andy Schmidt
H&M Systems Software, Inc.
600 East Crescent Avenue, Suite 203
Upper Saddle River, NJ 07458-1846
Phone: +1 201 934-3414 x20 (Business)
Fax: +1 201 934-9206
http://www.HM-Software.com/
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli
Sent: Thursday, October 09, 2003 09:58 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] maybe its just one of AOL's servers???
This was take directly off the header of emails I receive from AOL notifying
me that someone from one of my subnets was reported sending un-wanted email.
Fred
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
