🚀 go-pugleaf

Feico <feicorem0veth1s@gmx.net> wrote:

>Well, that's something I wonder. If the Bcc addresses are not in the message, how can it be
>delivered at all? Do you man that my provider deletes this information before it puts the message in
>the pop box?

It's not that your ISP is removing it per se. It's that there are two
levels to SMTP, the envelope (which is what the mail servers say to each
other) and the content (which is what will be sitting in your pop box).

This is an example of an SMTP conversation. -> signifies something
produced by the server, <- something I typed in:

-> 220 athena.episys.com ESMTP XWall v3.30
<- EHLO camera.episys.com
-> 250-athena.episys.com
<- MAIL FROM: alanb@episys.com
-> 250 2.1.0 originator <alanb@episys.com> ok
<- RCPT TO: alanb@episys.com
-> 250 2.1.5 recipient <alanb@episys.com> ok
<- DATA
-> 354 start mail input
<- From: alan
<- To: me
<- 
<- This is some text
<- And some more
<- .
-> 250 2.6.0 message accepted
<- QUIT
-> 221 2.0.0 athena.episys.com XWall v3.30 closing transmission channel

Note that everything the server says is preceded by a 3 digit number.
That number is what matters - the text that follows is useful, but not
fixed.

(Oh, and EHLO is not a misspelling.)

When I receive that message, the result looks like:

>Received: from athena.episys.com ([127.0.0.1]) by athena.episys.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2657.72)
>	id LP7AKN5J; Wed, 2 Jun 2004 16:57:55 +0100
>Received: from 193.129.251.130 [193.129.251.130]
>	by athena.episys.com
>	with XWall v3.30 ;
>	Wed, 2 Jun 2004 16:57:24 +0100
>From: alan
>To: me
>X-XWall-Bayes: 88
>X-XWall-Excl: global-e-mail 
>
>This is some text
>And some more

As you can see, there are two received headers indicating the path. (The
uppermost is the most recent.) There are two X-XWall headers (that's the
filter between our Exchange server and email senders). And the date got
added by the server, since it didn't already have one.

The rest is verbatim what I typed after the DATA command, up to but not
including the line that contained only a '.'. Note, the stuff before the
first blank line went in to the header.

The stuff that happened in the MAIL FROM and RCPT TO parts didn't end up
in the headers at all.

So, looking at those headers, the only one you can really trust is the
topmost Received one, because it was put there by the server you're
actually talking to, and you trust that server. The one below that
_could_ be forged. (i.e. I could have typed it in the DATA portion.) 

There are interesting problems in tracing the chain back, and spammers
are pretty good at attempting to put in forged Received headers in an
attempt to mislead victims.

>I expected there to be functions that are accesible from C++.

There will be - it'll be there under the Win32 API. As I said, I've not
done it from C++, so I don't know how to do it.

Alan Bellingham
-- 
ACCU Conference 2005 - 20-23 April, Randolph Hotel, Oxford, UK