Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

Are servers which do not include IP source information broken?

April 26, 2017Broken IP servers source

0

Posted

Are servers which do not include IP source information broken?

1 Answer

0

Posted

If your mail is received at a server which (sometimes) only reports the hostname of the sending server, you should not use that information to track spam. You should not use SpamCop if there is no IP address listed by your server for the source of the spam. Some mail servers, noteably Groupwise and McAfee’s SMTP proxy, do not record the source IP address of the sending server on all messages. Instead, they check the reverse DNS of the sending IP and if present, report that. However, reverse dns is unreliable. It can be set any way the remote site wants. For example, an IP in china could be configured to report a hostname of ‘hotmail.com’, even if the site has no connection to hotmail. Only by checking the reverse dns against the forward dns can it be relied upon. For example, if the name ‘hotmail.com’ is checked, it is found to be different than the chinese host claiming to be ‘hotmail.com’. Unfortunately, most mailservers which report only the hostname skip this critical check.