Hi,

I've configured qmail/vpopmail/courier to work for sending/recieving mails, with smtp authetnification, meaning that every user that would like to send mail thru mail server must use valid username and password.
But I noticed today, that users can manipulate return-path form.

For example if I set return-path in thunderbird as someman@intel.com the email will be sent and mail would look like someone relly sent it from intel.

Showed on example under.
My "real-username" at mail server is realuser@my-home-domain.com but as you can see I faked the return-path to something else.


Return-Path: <someone@intel.com>
Delivered-To: admin@my-home-domain.com
Received: (qmail 5267 invoked from network); 28 Mar 2007 11:56:43 -0000
Received: from somehost.fromuser (HELO usercomp2) (realuser@my-home-domain.com@12.34.56.78)
by mail.domain.org with SMTP; 28 Mar 2007 11:56:43 -0000
Message-ID: <000123c76f9d$eh6c9c70$1300a8c0@usercomp2>
From: My Name <someone@intel.com>
To: "Admin" <admin@my-home-domain.com>
References: <001101caaf8e$33f9e200$1700a8c0@usercomp2> <4607A127.90104@my-home-domain.com>
Subject: Changing Return-path/from unexisting user
Date: Wed, 28 Mar 2007 13:03:33 +0200
...
...


I would like to know is there any possibilty to force return-path and from field to be same as username (realuser@my-home-domain.com). It would be the best if I get some error message when I try to use fake mail address (different from my real username address).

any help

thanks

I've never seen a configuration that authenticates based on the From or Reply-to addresses; this is a common avenue for Spammers to send emails "from" domain email addresses. If this could be set, it'd be interesting to see how it scaled (the maintenance time would grow very quickly) when the server starts supply email services for domains, et cetera.