And what good does finding the MX records for a domain have to do with
knowing if received headers have traversed a valid sender IP address?
Next, this is easy to defeat, as I can simply toss in a legit received
line from a real paypal mail. That is unless you mean the current host
and not previous hops?
--- Wakko Warner <wakko@???> wrote:
> Marc Perkel wrote:
> > Richard Clayton wrote:
> > The sender is autoresponse@???
> > But the sending server in the received lines is
> accounting.paypal.com
> >
> > So - I want to grab just the "paypal.com" part can see if I can
> find
> > that in the received lines. It's part of my anti-phishing code. The
> idea
> > being that email from paypal.com will come from paypay servers
> somewhere
> > in received.
>
> What's so hard about this???
>
> mx custserv.paypal.com.
> > custserv.paypal.com does not exist, try again
> mx accounting.paypal.com.
> > accounting.paypal.com does not exist, try again
> mx paypal.com.
> > paypal.com MX 10 smtp1.sc5.paypal.com
> > paypal.com MX 10 smtp2.nix.paypal.com
> > paypal.com MX 10 smtp1.nix.paypal.com
> mx com.
> > com MX record currently not present
>
> Just strip the subdomain off until you get an MX. How difficult
> could that
> be??? You can do this with embedded perl and it would be quite easy
> to do.
>
> Or you could compare all MX's
>
> If you're wondering about say demon.co.uk:
> mx demon.co.uk.
> > demon.co.uk MX 5 lon1-hub-internal.mail.demon.net
> > demon.co.uk MX 5
> anchor-hub-internal.mail.demon.net
> mx co.uk.
> > co.uk MX record currently not present
> mx uk.
> > uk MX record currently not present
>
> I use a trailing . to force it not to look the domain up by using my
> local
> domain in /etc/resolv.conf
>
> --
> Lab tests show that use of micro$oft causes cancer in lab animals
> Got Gas???
>
> --
> ## List details at http://www.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://www.exim.org/eximwiki/
>
