Re: [exim] SPF Feature - Walk Received header

On Thu, 7 May 2009, Marc Perkel wrote:

> Granted that a spammer could forge received headers. Most don't.

It is still not uncommon, although in these days of compromised hosts
masquerading as bots, it is less necessary.

> If a spammer is forging received lines that might be detectable if they
> don't do a good job of it.

They just need to do a "good enough" job to throw the more naive
investigator off the scent. Reasonably seasoned investigators can easily
spot header forgery, however.

Jethro.

. . . . . . . . . . . . . . . . . . . . . . . . .
Jethro R Binks
Computing Officer, IT Services, University Of Strathclyde, Glasgow, UK