How are these mails being delivered

HCL Domino Domino Forum
1

HiSome of my users are recieving emails from various addresses which are not addressed to them. These mails are addressed to users which don’t exist at this domain. If I try to send a mail to these non-existant users from an external email account I receive a message saying that the user does not exist. Why is Notes deliviering mail to people when their name does not appear anywhere in the header of that message?

Has anyone else experienced this and can anyone explain how it is happening.

Thanks in advance.

Dave

2

Subject: How are these mails being delivered

I’ve already seen such behaviour with spam or probe mails… there’s one fake name in “To” and all other users are in “Bcc”…

NB. probably used as disturbing tech for various mail filters.

3

Subject: RE: How are these mails being delivered

Thanks for the reply Hugues. I can’t find any reference to the BCC field in the message header. Shouldn’t it be there?

Dave

4

Subject: RE: How are these mails being delivered

HI Dave

Did you ever resolve this? We are having the same issue here but it only seems to happen for one user.

Thanks

Ang

5

Subject: How are these mails being delivered

I think it’s down to “loopholes” in the SMTP protocol.

When the remote SMTP server delivers the message to domino, it will issue a

“rcpt to:” command containing the target address. However, if the sending

server also specifies a “to:” header, this will be used instead of the "rcpt

to:" in the notes document for display. You can check this be telnetting into

your smtp server as follows:

c:> telnet 25

this will return a string like:

220 ESMTP Service (Lotus Domino Release 6.5) ready at

Fri, 18 Jun 2004 03:54:12 -0500

you enter:

ehlo test

server responds:

250- Hello test (), pleased to meet you

250-HELP

250-SIZE

250 PIPELINING

you enter:

mail from: <sender’s address>

server responds:

250 … Sender OK

you enter:

rcpt to:

server responds (if accepted):

250 … Recipient OK

you enter:

data

server responds:

354 Enter message, end with “.” on a line by itself

you enter (noting the “.” on the last line):

to: fake.address@fake.domain.com

subject: Fake mail

body here

.

server responds:

250 Message accepted for delivery

the user you entered in the “rcpt to” command will now recieve a mail which

states that it is actually for “fake.address@fakedomain.com”

Yup - it’s that easy. It’s worrying how easy it is to fake a mail using this

method. All you need is telnet, and you can pretend to be a fully fledged email

client

6

Subject: RE: How are these mails being delivered

Just run another test with a different type of mail server.

What some servers do is put a header like this:

Received: from ()

      by <Server> with SMTP ID 878

      for <ACTUAL TARGET ADDRESS>;

      Fri, 18 Jun 2004 11:35:46 +0100 (BST)

where the actual target is the rcpt to.

However, domino only puts:

“from () by with ESMTP id 2004061804523848-2372 ; Fri, 18 Jun 2004 04:52:38 -0500”

Note the lack of target address.

7

Subject: RE: How are these mails being delivered

Many thanks for that detailed response Kieran. I just tried telneting into our server but was not allowed to connect on port 25. This does not tell me much as our mail gateway into the company is in the USA and I am in the UK. Their server may be vulnerable.

The other reply I recieved suggests the BCC field. I don’t seem to be able to read this anywhere in the message header. So this could be a simpler explanation.

Thanks

Dave

8

Subject: RE: How are these mails being delivered

If theres a bcc on the mail then there will be a BlindCopyTo field in Document Properties for that mail.

If not, then it must have spoofed the To field

It’s not a case of being vulnerable - this is how SMTP works. Chances are your mail gateway uses notes transport to get the mail into the uk server. Try using nslookup with type=mx to get the hostname for your mail.

C:> nslookup

set type=mx

.com

this will return something like:

Non-authoritative answer:

.com MX preference = 20, mail exchanger =

.com MX preference = 30, mail exchanger =

.com MX preference = 40, mail exchanger =

.com MX preference = 10, mail exchanger =

There will also be a load of stuff about IP addresses.

all you need to do is telnet into the mail host where MX Preference = 10. That will be your Mail Gateway host, which should then deliver the mail to domino.

Hope that helps

Kiers