Full Disclosure mailing list archives
Re: VeriSign's fake SMTP server for SiteFinder
From: Damian Gerow <damian () sentex net>
Date: Mon, 22 Sep 2003 16:32:20 -0400
Thus spake Richard M. Smith (rms () computerbytesman com) [22/09/03 16:24]:
Does anyone know why Verisign has set up a fake SMTP server at their SiteFinder service to bounce email messages sent to misspelled or expired domain names? The fake SiteFinder SMTP server gives the impression that it is a real SMTP server and happily accepts "To" and "From" email addresses before rejecting a misdirected email message.
So mail doesn't sit in queues across the world, trying to contact them.
I don't quite understand what technical issues Verisign is trying to solve here with a fake server. Any guesses?
To provide something that is (more) RFC compliant. The message before responding with a 220 to your first two commands, and a 500 to your third command. So you could do: < 220 Snubby > I like monkeys < 220 Okay > Do you like monkeys? < 220 Okay > But I like chimpanzees better. < 550 Relay access denied (I don't remember if that was the actual text, but you get the point). They've since installed a Postfix server that at least understands SMTP, and rejects at the proper spot. It's still RFC-broken, however (doesn't accept postmaster@), and it bounces mail for legitimate domains (a side effect of the way Verisign implemented their wildcards). - Damian _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- VeriSign's fake SMTP server for SiteFinder Richard M. Smith (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Pamela Patterson (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Brent J. Nordquist (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Michal Zalewski (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Damian Gerow (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder fulldisclosure (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Dan Rowles (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Jonathan A. Zdziarski (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Joshua Levitsky (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Valdis . Kletnieks (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Jonathan A. Zdziarski (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Nate Hill (Sep 22)
- <Possible follow-ups>
- RE: VeriSign's fake SMTP server for SiteFinder Joshua Thomas (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Joshua Levitsky (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Geoincidents (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Ng Pheng Siong (Sep 22)
- Re: VeriSign's fake SMTP server for SiteFinder Joshua Levitsky (Sep 22)