3 ms·

Back in the early 2000's I worked for a company that was the lead firm doing analysis of email spammers for later targeting by the law firms of the big free ema

Back in the early 2000's I worked for a company that was the lead firm doing analysis of email spammers for later targeting by the law firms of the big free email providers. The phrase "be liberal in what you accept, and conservative in what you send" certainly applied to SMTP which led to all kinds of craziness in spam. For example: - Emails with multiple "From" fields in the headers - Totally bogus relay chain data - all kinds of other garbage in random fields - sender IPs that were faked etc This was also around the time that spammers were switching to using bas64 MIME encoded images to get around text filters. The company I worked for actually got pretty good at analysing the spam thanks to a combination of a IMDB style web based browser for the spam I put together and good old fashioned "leg work" to track the owner of URLs, merchant accounts etc. That in turn led to some of the spammers actually shutting down. More details here: https://twitter.com/alexpotato/status/1208948480867127296 https://twitter.com/alexpotato/status/1208948480867127296

romanixromanix 5y ago
>> Emails with multiple "From" fields in the headers Do you think this is still possible?
- gumby 5y ago
  Sure better be, for the sake of backwards compatibility. This isn't a problem for mail transport as the recipient is specified in the envelope and the message itself is not examined. What a client should do in such a case is unclear. I suspect that they all use the first one encountered and ignore the rest.
- secabeen 5y ago
  Multiple From: fields are allowed by https://tools.ietf.org/html/rfc5322#section-3.6.2 https://tools.ietf.org/html/rfc5322#section-3.6.2 as long as a Sender: is also included.
  - KasparEtter 5y ago
    Just to be precise: It's a single From field with several addresses, not multiple From fields (see https://tools.ietf.org/html/rfc5322#page-21 https://tools.ietf.org/html/rfc5322#page-21). RFC 6854 updated the From field to allow an empty group construct (see https://explained-from-first-principles.com/email/#no-reply https://explained-from-first-principles.com/email/#no-reply) but mainly for other reasons (see https://explained-from-first-principles.com/email/#email-address-internationalization https://explained-from-first-principles.com/email/#email-add...). DMARC authentication either rejects multiple addresses in the From field or authenticates them all and applies the most strict policy (see https://explained-from-first-principles.com/email/#domain-based-message-authentication-reporting-and-conformance https://explained-from-first-principles.com/email/#domain-ba...).
walrus01 5y ago
> - Totally bogus relay chain data - all kinds of other garbage in random fields - sender IPs that were faked etc Anyone interested in looking at all the possible permutations of spam, can view the spamassassin rule sets which are quite comprehensive by now. Spamassassin has been around for close to 20 years.

romanixromanix 5y ago

>> Emails with multiple "From" fields in the headers Do you think this is still possible?

gumby 5y ago
Sure better be, for the sake of backwards compatibility. This isn't a problem for mail transport as the recipient is specified in the envelope and the message itself is not examined. What a client should do in such a case is unclear. I suspect that they all use the first one encountered and ignore the rest.
secabeen 5y ago
Multiple From: fields are allowed by https://tools.ietf.org/html/rfc5322#section-3.6.2 https://tools.ietf.org/html/rfc5322#section-3.6.2 as long as a Sender: is also included.
- KasparEtter 5y ago
  Just to be precise: It's a single From field with several addresses, not multiple From fields (see https://tools.ietf.org/html/rfc5322#page-21 https://tools.ietf.org/html/rfc5322#page-21). RFC 6854 updated the From field to allow an empty group construct (see https://explained-from-first-principles.com/email/#no-reply https://explained-from-first-principles.com/email/#no-reply) but mainly for other reasons (see https://explained-from-first-principles.com/email/#email-address-internationalization https://explained-from-first-principles.com/email/#email-add...). DMARC authentication either rejects multiple addresses in the From field or authenticates them all and applies the most strict policy (see https://explained-from-first-principles.com/email/#domain-based-message-authentication-reporting-and-conformance https://explained-from-first-principles.com/email/#domain-ba...).

walrus01 5y ago

> - Totally bogus relay chain data - all kinds of other garbage in random fields - sender IPs that were faked etc Anyone interested in looking at all the possible permutations of spam, can view the spamassassin rule sets which are quite comprehensive by now. Spamassassin has been around for close to 20 years.