The results were interesting. I was specifically wondering how the war between Sendmail and Postfix was going. As expected, Sendmail is still winning, but Postfix seems to be holding its own.

So out of 36 responses I got 7 with Postfix in the banner. If we take that highly unscientific sample and call it legit, we’re looking at roughly 20% of top-50 universities using Postfix. Not bad.

Aside from the MTA war, though, it was just interesting to see what these guys were putting in their banners. Check out the Princeton one, for example — they have some sort of secret message encoded with MD5 in theirs. And MIT points out that they don’t want any collect or third party calls. Nice.

Anyway, here are the results and the tool I used. Be sure to check out the raw output as well; there are quite a few interesting tidbits in there.:

Files

[ The Results ]
[ The Raw Results ]
[ The Script I Used ]
[ The List of Universities I Used ]

Here are the headers:

So SPF caught it but it failed “soft”. At what point do we as mail server admins (Google in this case) start dropping these emails instead of letting them through?

Or, to put it another way, what part of an official email from PayPal coming from mail.royalimaging.net (64.2.112.131.ptr.us.xo.net [64.2.112.131]) doesn’t make you want to drop it?

grrr.

It’s email you want – but not right now.

[ Bacn ]

A few I’ll still interact with through my mail client, i.e. those that I participate actively in more often, but for the majority of them I’m going to be moving to RSS. Here’s a short list of feeds you might want to look at:

• Bugtraq
• Full Disclosure
• Nmap Hackers

And here’s a comprehensive list from seclist.org.

What this means is that I can finally use real domain names in my certificates (self-signed) for two separate hostnames while avoiding the annoying prompts that OS X likes to throw when it senses tomfoolery.

Here are the steps:

• Create your Postfix certificates the way Weitse wants you to, using your SMTP hostname.
• Import both the CA cert and your actual Postfix certificate into OS X.
• For IMAP, edit your imapd.cnf file to reflect your IMAP hostname, etc.
• Run mkimapdcert.
• Import that certificate into OS X.

Now when you open Mail.app you should not get prompted to accept any certificates. The trick is that you need to import the CA’s cert on the Postfix side or it won’t work. But with courier this is not required. It has something to do with the format of the certificates being different.

It’s on my list of things to research, but for now I’m just happy I got it working exactly as I want it.

Yeah, I think we’re losing this battle. I’m thinking of checking out a service like MXLogic.

220 plgmler2.imr.gm.com ESMTP Sendmail GM Secure; Thu, 17 Aug 2006 23:23:21 -0500
220 mail11.disney.com Postfix EGGS and Butter 
220 IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted
220 Medco - Ready 220 mailgate2.safeway.com ESMTP ***** SMTP Ready *****
220 mail1.cat.com ESMTP Microsoft Exchange Internet Mail Service 5.5.2657.72) ready
220 Northrop Grumman Corporation Ready
220 mms01bas.mms.us.syntegra.com (IntraStore TurboSendmail) ESMTP Service ready
220 [12.43.78.22] ESMTP
220 wamu.com Proxy Server 220 fdsmail01.fds.com Microsoft ESMTP MAIL Service, Version:
5.0.2195.6713 ready at Fri, 18 Aug 2006 00:31:58 -0400

We also get to see some personality in the way the servers say goodbye (SMTP 221):

221 Bye
221 Until later [69.214.242.13]
221 Catch you later

Input

The Script The Company File

Output

The Complete Banners The Exit Messages

–

** Note: There’s a fine line between being curious about interesting service banners and portscanning. If you don’t know what that difference is then you probably shouldn’t be doing this at home. :)

These people are going through Gmail and Spamassasin filters like they aren’t there. I guarantee you they’re all stupid rich, too. Here’s my quick-fix via .mailfilter thanks to them always putting that text in the From: field: # Wonderful Spam if ( /^From:.*Wonderful.Buys.com/ ) { to "Maildir/.Junk" }

I’ll know tomorrow if I got the syntax right…