Re: Spamcop failing to detect true originating IP

On Wed, 13 Jul 2005 13:44:00 -0400, wskrispy wrote:

>  From one vantage point I'm almost tempted to say that, well, it looks 
> like the spammer has outwitted Spamcop. You say "there is no way that SC 
> has (can) determine the source of the spam". If that's so, wouldn't you 
> agree the spammer has found a spoofing method that confounds Spamcop?

No. Spammers use spoofed "HELO" strings all of the time. I see a lot of
attempts to dump email on my server with "HELO mail.yahoo.com", followed by
the connecting IP address; that IP address is never a yahoo.com IP address.
The important point to note is that the spammer can't control the IP
address which my MX is seeing. If the MX is properly configured, it will
show the connecting IP address; at that point, SpamCop can proceed. But
whether that IP address is present, or not, in the headers is beyond the
control of the spammer. The responsibility to log the IP addresses of the
incoming connections lies squarely on the receiving email server.
Therefore, it is your own email system which is outwitting SpamCop. It
would also outwit Sam Spade, and me.

> This server is a Virtual Private Server under a hosting company. I 
> administer it for an artist's studio. I'm a retired programmer, not an 
> Admin. But I know enough to get LANs up and running and to provide basic 
> WWW/FTP/Email services and troubleshoooting for small businesses. As far 
> as I can tell, this server is configured with typical options and its 
> primary mailer program (Exim) is not writing anything unusual to emails, 
> nor deleting or scrambling headers.

It is, however, omitting certain information which is available to it, and
could be included; namely, the IP address of the incoming connection.

-- 
Norman
~Shine, bright morning light,
~now in the air the spring is coming.
~Sweet, blowing wind,
~singing down the hills and valleys.