RE: "send to a friend" from websites

[Stuart D. Gathman]
>You might be able to use a Python SRS implementation on 
>Windows - which has will supported Python VMs:  
>http://www.bmsi.com/python/pysrs.html

There are good Perl interpreters for Windows as well. I like Python much
better, though. Still, integration with the MTA is hard. The concept of
an "event sink" API exists for adding hooks into the Windows SMTP
services, but I am not too familiar with that. Is there an SRS-enabled
SMTP proxy available out there? That would seem ideal, and would work
with any MTA if written in a cross-platform language like Python.
 
>1) Use [email protected] as sender, accept bounces, and save them
>to a mailbox where they can be examined and forwarded manually and/or
>expired after a time limit.

I like that idea; it would enable us to eliminate the majority of the
problem and only handle outlying cases. Traffic is not high, so our
customer service people could take care of this easily. And I don't have
to mess with gluing experimental code into my MTA.

>
>2) Like 1, but examine the bounce to find a custom 
>X-ForwardedSender header 
>where you saved the purported sender.  You might want to add a crypto
>cookie to your X-ForwardedSender header to prevent spammers from
>using your system for a relay. (Similar to SRS, but doesn't 
>involve MTA.)

If I was going to do that much coding, I would just try to do full SRS
by writing my own even sinks for the Windows SMTP server, I think.

>
>3) Do some checks on the sender before accepting it.  Make sure it is
>not blacklisted.  If the sender does not publish SPF, then use it as
>is instead of [email protected].  If the sender begins with 
>SRS or SES,
>then validate it via CBV, and if it checks out, use as is.  Otherwise,
>proceed as in 1 or 2.

Interesting.

>
>4) Proceed as in 3, but use SRS instead of 1 or 2.  This requires you
>to integrate SRS with your MTA.

Maybe. Hopefully my anti-spam vendor will support SPF+SRS in their next
release. They already use event sinks to call their filter, so they
could definitely handle this sort of thing. They'll want to add SPF
checks into their filters anyway. I'll make the suggestion to them.

Thanks for your help,
	Ryan