Shuttle transits the Sun

[Snowreap]

the SMTP headers can be tampered with, easily. but despite this they still can form a verification chain. in the example above, I know that KENMSG25 and kenmsgsmtp01 are trustworthy -- they're part of our company's Exchange infrastructure and I know that nobody in my company's Exchange team is going to fake recruiting emails.

further, I can see from the headers that our firewall (kenmsgip02) received the email from "m1.seng.bendtel.com". theoretically, I could verify that "bendbroadband.com" is associated with "bendtel", and that "Wirth and Associates" is a customer of "bend broadband".

but if, for example, I received an email purporting to be from Microsoft, recommending that I download and install a patch, but our firewall received the message from a cablevision IP address, then I could be fairly certain that any of the headers beyond that point are suspect -- there is no reason for Microsoft to route their emails through the cablevision network.

-ken