So why not use a callback instead? [LWN.net]

So why not use a callback instead?

Posted Sep 6, 2004 10:25 UTC (Mon) by neilbrown (subscriber, #359)
In reply to: So why not use a callback instead? by leonbrooks
Parent article: Debian rejects Sender ID

This is often referred to as "CBV" - call-back-verification.

The "from" address that is normally used is "<>". For other addresses it is possible to get false rejects.

The problem with this is that it allows an untraceable DOS attack. If some malcontent sent spam from thousands of "owned" machines all claiming to be from <axxx@my.domain>, then if all the recipients of that spam did CBV to my mailserver, it might be a very serious hit coming from genuine mail servers.

This may be a spectre rather than a real problem, and I'm seriously considering implementing it. However it doesn't really help stopped fakes or unwanted mail, at least not in the long run. It would server to keep the queue of outgoing bounces short though.

(Log in to post comments)