[tamarian]

Originally Posted by Paul M

I am actually testing what seems a very simple answer to the above, which also gives me something consistant to look for in the returned mails.

I use the following code to add two headers to every outgoing e-mail

PHP Code:

$mycode = "qwertyuiop"; // change this to something unique //
$headers .= "X-Tracker-Dst: " . $toemail . $delimiter;
$headers .= "X-Tracker-Chk: ". MD5($toemail . $mycode) . $delimiter; 


Every system that bounces mail should return the original headers (all that I have tested do) so you get these headers back with all failures.

The bouncer code then scans the inbox looking for all the X-Tracker-Dst headers to get the original destination, and pulls the X-Tracker-chk for each one. It then does the same MD5 calculation and if it's a match it knows it was a genuine bounce. To spoof this - the spoofer would need to know your unique code in order to get the MD5 correct. It also means that all I need to look for in the rejects inbox is these two headers.

I like the idea. But I'm not sure you will get all your headers back, I think it will depend on the ISP. I think AOL would be one of the ISP's that won't give you back all the headers, and some would give it back depending on the bounce type.

But I will test it out, and see if the percentage of those who do return it. If it's reasonably high enough (50+%), I think it would be worth it. An option can be added to see if the admin want to to rely on it, or ignore it.