Bruce Toback wrote:
> Jeff Kell writes:

> >In your example above, the mail
> >probably didn't originate at "airmail.net" but could instead have
> >been injected at any number of PPP sites (signup for a trial account,
> >inject your spam, disappear from sight).
>
> It's worse than that, Jeff. The mail can be made to appear originate from
> ANY site running sendmail -- which is almost every site.

Depends on what sendmail.  The "basic" stuff takes the SMTP HELO name
and uses it as from.  This has been enhanced once to list the IP
address of the origin, and enhanced again to do a reverse DNS on the
origin IP.

Jeff Kell <[log in to unmask]>