Subject: Re: Bug in 1.7.6?

From: [email-masked] (Christopher C. Stacy)
Date: Tue, 12 Oct 1993 15:58:29 -0700

Date: Tue, 12 Oct 1993 15:12:49 PDT
   From: [email-masked]

   I do have to wonder if the folks who've complained about Thomas'
   code to verify a mail address noticed that he was using the VRFY
   option of SMTP.  This sure as heck ought to verify an email address -
   that's what it's there for - except in cases where the other end has
   intentionally or unintentionally subverted the process.

   I'd say that if you want to verify an email address, this is your
   best shot.  It's not perfect but it's the best you can do right now.

   This doesn't speak to any other problems with the code.

Mike,

The problem is that this approach presupposes that the righthand part
of the address (eg., "aero.org") is the name of a host connected
to the Internet, and further that said host is where the user
named in the lefthand part ("obrien") is to receive their mail.

Neither of those assumptions are correct in many cases.

The algorithm for verifying a mail address would be as follows.
Search the distributed domain database (DNS) for an MX record matching
righthand part.  If found, use that as the host, and use DNS to resolve 
this new host name.  Otherwise, use DNS to resolve the righthand part
itself, since it must really be a mail host.  (At this point, you have
either failed, or you have the address from an A record.)
Now connect to that host, and use the VRFY command.

Your next problem is that some hosts will accept any properly formed
(or maybe even ill formed) address in the VRFY command, because their
mailer back-end will try to forward anything handed to it, and the
front-end can't know if an address will turn out to work or not.
This is why sometimes you send mail to a host, and get back a receipt
message saying "No such user".  The foreign host accepted the recipient
that your host specified, but then it was later discovered not to be valid.

The net is really in some sense "too distributed" to do the kind of
verification you're asking for.

Cheers,
Chris

---

From: [email-masked]
Date: Tue, 12 Oct 1993 16:06:42 -0700

You are quite right; I knew this; how embarassing.

	To be correct the code must first get the MX record from the
local DNS resolver, and then try the VRFY operation on the resulting
host.

	The second point you raise, about over-enthusiastic gateway
hosts, is in fact a problem with the gateway.  VRFY should return
a correct result and it is not the enquirer's responsibility if the
gateway decides to lie about it.  I have seen such gateways which
accept all legal addresses, then send failed-mail messages back for
the ones which are no good.  What a crock.  This one's legitimate
grounds for dinging the postmaster.

---

From: [email-masked] (Christopher C. Stacy)
Date: Tue, 12 Oct 1993 16:09:18 -0700

Be conservative in what you send, liberal in what you accept.

---

From: [email-masked]
Date: Tue, 12 Oct 1993 16:15:40 -0700

>>Be conservative in what you send, liberal in what you accept.

	True; Mr. Protocol has stated this often.  When applied to mail
gateways, the gateway is accepting an address and should be
able to perform miraculous de-manglings upon it, in an ideal world.

	What it is sending is assurance that it knows how to deliver to
that address.  Boy howdy do I think it should be conservative here.
This is one of the major bonehead areas of the current Internet, to my
mind, and is going to lead to a world of hurt.

	This whole track is probably way off what moo-cows should
be discussing but it does serve to demonstrate what kind of awful
pain the MOO community is in for as it attempts to make use of
established Internet services through construction of what amounts
to a whole new generation of clients.

Mike