Subject: Re: Bug in 1.7.6?

From: "M. Strata Rose" <[email-masked]>
Date: Tue, 12 Oct 1993 11:23:06 -0700

Thomas, I don't know the new server so I can't speak to that portion of
your posting, but I do know that if you are using that code to validate
email addresses, people with a valid email address using an MX record (Mail
eXchanger) will be denied access. MX records transparently funnel mail
to another system which receives it in lieu of the actual address, but
this is done "inside" an MX-compatible/configured sendmail and a straight
telnet to the alleged host will always fail.  

MX-ing all mail for a given commercial site to a single firewall machine 
is a standard practice these days, so you might want to consider a 
different method of verifying email addresses.  I would suggest either 
parsing the address to see if it meets RFC-822 or setting up some kind
of listserv agent which attempts to send mail of the form: 
myagent%myaddress@theiraddress  and looks for a reply, showing that mail
was routed through their system back to you.  Of course, this may still
fail with UUCP sites that connect only every few hours, weird fidomail 
gateways, misconfigured mailers, etc.  Depends on how strongly you want
to make sure the person has an email address.

Cheers,

_Strata

M. Strata Rose
Unix & Network Consultant, SysAdmin & Internet Information 
Virtual City Project
[email-masked] | [email-masked] | [email-masked] | [email-masked]

---

From: [email-masked]
Date: Tue, 12 Oct 1993 15:12:49 -0700

I do have to wonder if the folks who've complained about Thomas'
code to verify a mail address noticed that he was using the VRFY
option of SMTP.  This sure as heck ought to verify an email address -
that's what it's there for - except in cases where the other end has
intentionally or unintentionally subverted the process.

	I'd say that if you want to verify an email address, this is your
best shot.  It's not perfect but it's the best you can do right now.

	This doesn't speak to any other problems with the code.

Mike O'Brien