主页 / server / 问题 / 766001
Accepted
morleyc
Asked: 2016-03-25 15:27:58 +0800 CST

检查欺骗性电子邮件的 SMTP 标头（客户端是否进行了身份验证？）

  • 772

我一直在使用 rackspace 电子邮件服务，并且我发现流氓电子邮件看似来自该用户[email protected]，[email protected]但实际上从未由该用户发送。

根据 rackspace，这封电子邮件是通过[email protected]使用他的凭据发送的。从电子邮件标题中，我无法判断这是在secureserver.net上运行的脚本正在执行此操作（使用他的凭据）还是发送欺骗性电子邮件（脚本在没有身份验证的情况下发送SMTP，只是将电子邮件设置为/从相应的字段）。

我的问题是：

  1. SMTP 服务器可以通过两种方式接收电子邮件：1) 来自其他 SMTP 服务器，2) 或来自通过它进行身份验证和中继的客户端。如果无法访问接收服务器日志，标头中指示客户端通过经过身份验证的用户名/密码进行中继的详细信息在哪里？

  2. 在添加了其他详细信息的地方，这些是来自发件人的欺骗还是真实的：X-Get-Message-Sender-Via: a2plcpnl0576.prod.iad2.secureserver.net: authenticated_id:[email protected]？

  3. 尽管我们的域的 SPF 记录仅包含网络服务器 IP 和include:emailsrvr.com标志-all，但 Rackspace 表示无法使用它来检查欺骗性电子邮件，或者这是因为它们已通过 SMTP 服务器的身份验证并在这种情况下中继?

标题如下：

Delivered-To:   [email protected]
Return-Path:    <[email protected]>
Received:   from smtp48.gate.iad3a (smtp48.gate.iad3a.rsapps.net [172.27.146.93]) by store370a.mail.iad3a (SMTP Server) with ESMTP id 6B21338004D for <[email protected]>; Tue, 22 Mar 2016 18:51:50 -0400 (EDT)
X-Spam-Threshold:   95
X-Spam-Score:   0
X-Spam-Flag:    NO
X-Virus-Scanned:    OK
X-MessageSniffer-Scan-Result:   0
X-MessageSniffer-Rules: 0-0-0-5195-c
X-CMAE-Scan-Result: 0
X-CNFS-Analysis:    v=2.1 cv=Ksx0hwmN c=1 sm=0 tr=0 a=03oFrmF08fajSB7oc4goJw==:117 a=3DDquuGS2V5BkRhJnJP3ow==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=AsRiV6KZ74iSbj+k8RJYJIAeGPg=:19 a=2L8f7PMcNrQA:10 a=7OsogOcEt9IA:10 a=KXl77lDgDEgIEtoqJYcA:9 a=_6GpL_ENAAAA:8 a=ZYf_q_66Zn7mdDxIrUkA:9 a=giY71Mj1q15_ivv6:21 a=NF3jo81ehh1LRULu:21 a=wPNLvfGTeEIA:10 a=xupg4knwUDYA:10 a=iDzWDAaf-0_1B4d3PKkA:9 a=AX674DPcPDPt-UkY:21 a=v5bIRgG1RGZFvm2Y:21 a=_W_S_7VecoQA:10
X-Orig-To:  [email protected]
X-Originating-Ip:   [198.71.225.37]
Received:   from [198.71.225.37] ([198.71.225.37:50277] helo=a2nlsmtp01-03.prod.iad2.secureserver.net) by smtp48.gate.iad3a.rsapps.net (envelope-from <[email protected]>) (ecelerity 2.2.3.49 r(42060/42061)) with ESMTPS (cipher=AES256-SHA) id B2/C7-21891-17EB1F65; Tue, 22 Mar 2016 18:51:50 -0400
Received:   from a2plcpnl0576.prod.iad2.secureserver.net ([198.71.236.72]) by : HOSTING RELAY : with SMTP id iUAOaPfNohy43iUAOaMLT4; Tue, 22 Mar 2016 14:48:44 -0700
Message-ID: <[email protected]>
Received:   from [77.234.42.143] (port=65110 helo=[100.100.48.14]) by a2plcpnl0576.prod.iad2.secureserver.net with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.85_1) (envelope-from <[email protected]>) id 1aiUAO-0010vj-5P for [email protected]; Tue, 22 Mar 2016 14:48:44 -0700
Content-Type:   multipart/alternative; boundary="===============0122389713=="
MIME-Version:   1.0
Subject:    Important
To: Recipients <[email protected]>
From:   "Harry" <[email protected]>
Date:   Tue, 22 Mar 2016 16:48:39 -0500
Reply-To:   [email protected]
X-Antivirus:    avast! (VPS 160322-0, 03/22/2016), Outbound message
X-Antivirus-Status: Clean
X-AntiAbuse:    This header was added to track abuse, please include it with any abuse report
X-AntiAbuse:    Primary Hostname - a2plcpnl0576.prod.iad2.secureserver.net
X-AntiAbuse:    Original Domain - mydomain.com
X-AntiAbuse:    Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse:    Sender Address Domain - mydomain.com
X-Get-Message-Sender-Via:   a2plcpnl0576.prod.iad2.secureserver.net: authenticated_id: [email protected]
X-Source:   
X-Source-Args:  
X-Source-Dir:   
X-CMAE-Envelope:        MS4wfEPENpifHOCgRpfP6548FFaFh5aGvLkdZm1fLn1ObUi/GIxIvKJEpHzquISJMsZqy70pnMkKI97Q9A0DqQ32JQ78HW6S1tBah8JgoDrTNI9F4pp4EDOM HTkGtTYtUC9r9UUrKvESTtmSFszS6652/MgX84oIFe88If6ClU4eOj36h5+xgnUIKFWOr106/ju1qIlkFmQeQS7UynivyRiK6r8QHvsju7aabN+eUPHBb+4qI
smtp

1 个回答

  1. Best Answer

    关键线在这里。

    Received: 
   from [77.234.42.143] (port=65110 helo=[100.100.48.14]) 
   by a2plcpnl0576.prod.iad2.secureserver.net 
   with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.85_1) 
   (envelope-from <[email protected]>) id 1aiUAO-0010vj-5P 
   for [email protected]; Tue, 22 Mar 2016 14:48:44 -0700

    它说a2plcpnl0576.prod.iad2.secureserver.net收到了一条带有SMTP AUTH的消息，此处缩写为ESMTPSAfrom [77.234.42.143]which 标识为[100.100.48.14]（来自第二层非公共 IP 地址空间，即运营商级 NAT）。

    77.234.42.143解决ten.emfme.net哪个应该给我们实际的发件人。由于此 IP 地址属于 AVAST 云，您可能会从[email protected].

    • 3

相关问题