Re: "send to a friend" from websites

On Tue, 18 May 2004, Ryan Malayter wrote:

> Or do I need to use SRS for this to properly relay bounces to the third
> party? I think I'm supposed to, but I do not have any SRS implementation
> installed on these Win2k MTAs. Would it be against RFCs to ignore the
> bounces? I mean, the [email protected] is a valid address, so the
> outgoing message does have a valid return path. We don't really care if
> the third party ever sees the bounces.

You might be able to use a Python SRS implementation on Windows - which
has will supported Python VMs:  http://www.bmsi.com/python/pysrs.html

I can think of several levels of support for your site:

1) Use [email protected] as sender, accept bounces, and save them
to a mailbox where they can be examined and forwarded manually and/or
expired after a time limit.

2) Like 1, but examine the bounce to find a custom X-ForwardedSender header 
where you saved the purported sender.  You might want to add a crypto
cookie to your X-ForwardedSender header to prevent spammers from
using your system for a relay. (Similar to SRS, but doesn't involve MTA.)

3) Do some checks on the sender before accepting it.  Make sure it is
not blacklisted.  If the sender does not publish SPF, then use it as
is instead of [email protected].  If the sender begins with SRS or SES,
then validate it via CBV, and if it checks out, use as is.  Otherwise,
proceed as in 1 or 2.

4) Proceed as in 3, but use SRS instead of 1 or 2.  This requires you
to integrate SRS with your MTA.

-- 
	      Stuart D. Gathman <[email protected]>
    Business Management Systems Inc.  Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flamis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.