ࡱ> ` :bjbjss >&zzz86jhN"pppKRih~$ih^ذKKذذppذ\ pp~ذ~\Xpڦ pb{pz4( t0 /ܽf/P:/6ѭlYѭѭѭBXѭѭѭذذذذX_B_  NASA SEWP Security Center Using Sender ID in a Linux Environment Erika McCallister Scott He September 16, 2005 DISCLAIMER This document is intended for informational purposes only. It represents the NASA SEWP Security Centers experiences using Sender ID in a Linux environment. There are no express or implied warranties regarding the veracity of the information provided. There are no guarantees that your experiences with Sid-milter, Fedora, or Sendmail will be similar. Table of Contents  TOC \o "1-3" \u 1 Overview of Sender ID  PAGEREF _Toc114641940 \h 3 1.2 Algorithm for PRA  PAGEREF _Toc114641941 \h 3 2 Installing Sendmail and Sid-milter on Fedora Core 4  PAGEREF _Toc114641942 \h 3 2.1 Sendmail Installation for use with Sid-milter  PAGEREF _Toc114641943 \h 3 2.2 The Berkeley Database Installation  PAGEREF _Toc114641944 \h 3 2.3 Sid-milter Installation  PAGEREF _Toc114641945 \h 3 2.4 Using Sid-filter with Sendmail  PAGEREF _Toc114641946 \h 3 2.5 Using Sendmail with an MX Record  PAGEREF _Toc114641947 \h 3 3 SPF Records  PAGEREF _Toc114641948 \h 3 3.1 Examples  PAGEREF _Toc114641949 \h 3 4 Our Evaluation of Sender ID Using Sendmail with Sid-filter  PAGEREF _Toc114641950 \h 3 4.1 Basic Testing Sender ID  PAGEREF _Toc114641951 \h 3 4.2 The Effect of Sender ID on DNS  PAGEREF _Toc114641952 \h 3 4.3 Forgery and Spoofing Tests  PAGEREF _Toc114641953 \h 3 4.3.1 Forging Return Addresses for Bounced Messages  PAGEREF _Toc114641954 \h 3 4.4 An Interesting Quirk  PAGEREF _Toc114641955 \h 3 5 Limitations of Sender ID  PAGEREF _Toc114641956 \h 3 6 References  PAGEREF _Toc114641957 \h 3  1 Overview of Sender ID Sender ID is a tool that was created to prevent spam and email forgery. It uses the DNS to authenticate the origin of email. Each time a mail server receives an email, it extracts the domain of the sender and the originating IP address from the message. The mail server then checks the information against a special record in the DNS. The special record is called an SPF record, and it contains a list of IP addresses permitted to send email from the particular domain. If the information extracted from the email message matches the SPF record, then the message is delivered to the appropriate mailbox. Information that does not match the SPF record can be handled in several ways based on the policies of the receiver. Sender ID is the result of a compromise between two existing authentication protocols. Although both protocols work as described above by checking the DNS, the protocols differ based on how they determine the correct sender domain. Microsoft created a protocol called Caller ID. Caller ID relied on the Purported Responsible Address (PRA), which is usually defined as the RFC 2822 sender field. This sender field is the from field within the message header. In some circumstances, the PRA is defined to be another field (see section 1.2). In contrast, PO Box created the Sender Policy Framework (SPF) protocol, which uses the RFC 2821 sender field. The RFC 2821 sender field is the MAIL-from field in the SMTP protocol data. The advantage to SPF is that the sender can be authenticated before the message is sent and parsed. However, SPF has a higher rate of false positives than Caller ID. SPF is still used as a stand-alone authentication method. Microsoft provided an outline of the basic steps of how Sender ID works: The sender transmits an e-mail message to the receiver. The receiver's inbound mail server receives the mail. The inbound server checks which domain claims to have sent the message, and checks the DNS for the SPF record of that domain. The inbound server determines if the sending e-mail server's IP address matches any of the IP addresses that are published in the SPF record. If the IP addresses match, the mail is authenticated and delivered to the receiver. If the addresses do not match, the mail fails authentication and is not delivered. 1.2 Algorithm for PRA The PRA is usually the from field of the message header. However, is some cases, it is defined to be other fields, such as the resent-sender header. The PRA algorithm has the following steps: Select the first non-empty Resent-Sender header in the message. If no such header is found, continue with step 2. If it is preceded by a non-empty Resent-From header and one or more Received or Return-Path headers occur after said Resent-From header and before the Resent-Sender header, continue with step 2. Otherwise, proceed to step 5. Select the first non-empty Resent-From header in the message. If a Resent-From header is found, proceed to step 5. Otherwise, continue with step 3. Select all the non-empty Sender headers in the message. If there are no such headers, continue with step 4. If there is exactly one such header, proceed to step 5. If there is more than one such header, proceed to step 6. Select all the non-empty From headers in the message. If there is exactly one such header, continue with step 5. Otherwise, proceed to step 6. A previous step has selected a single header from the message. If that header is malformed (e.g. it appears to contain multiple mailboxes, or the single mailbox is hopelessly malformed, or the single mailbox does not contain a domain name), continue with step 6. Otherwise, return that single mailbox as the Purported Responsible Address. The message is ill-formed, and it is impossible to determine a Purported Responsible Address. 2 Installing Sendmail and Sid-milter on Fedora Core 4 As Linux newbies, our task of creating a network test environment for the new Sid-milter email filter for Sendmail was quite daunting. We installed our Fedora Core 4 cds and ventured forth into the unknown. It wasnt completely unknown; we were familiar with the basics (i.e. rmdir, ls, cd, etc.). However, our greenness with Linux was pretty apparent right away as we struggled with the topic of disabling unnecessary services and preventing them from restarting upon reboot. We conquered this task, mastered NMAP, and we were ready to install Sendmail. You may ask why we would install a fresh version of Sendmail when Fedora comes pre-loaded with Sendmail. The answer is Libmilter. The default install of Sendmail does not include this library, including the magical libmilter.a file, which is required to run any milter (aka mail filter). Youll realize quickly that the magical file is missing if you receive about 300 error messages when trying to install a milter. Once you have your first box ready to go, you may want to clone it to create more boxes for a test network. We discovered that the use of LVM in Fedora Core 4 made using Norton Ghost 2003 nearly impossible. We finally gave up and just manually installed the OS and software for the other three machines in our network. We downloaded the newest stable version of Sendmail (8.13.4). The first step we recommend is reading the instructions. I repeat, read the instructions. This simple approach eluded us for a while. The instruction file is aptly entitled, README. This file will greatly reduce your level of confusion. Here are the steps we took to install Sendmail while ensuring that libmilter built and installed correctly. There is one caveat. Each time we installed Sendmail, we received slightly different errors, even though we used the same procedure on identical machines. Be ready for anything. Well try to cover all of the issues we encountered. Some issues merely reflect our amateur status in the use of configuration files. On the bright side, we learned a lot from this process and no longer feel like complete newbies. 2.1 Sendmail Installation for use with Sid-milter Download Sendmail 8.13.4 from  HYPERLINK "http://www.sendmail.org" http://www.sendmail.org Make sure you have a good chunk of time available. Make sure that your box is recognized on the network by adding it to the DNS. Uninstall Sendmail if it is already installed. We prefer the yum method: # yum remove Sendmail Download Sendmail 8.13.4 at sendmail.org Extract the package to usr/local From the new Sendmail directory, build libmilter: # cd /usr/local/sendmail/libmilter # sh Build # sh Build install Do a quick search for libmilter.a. This will save you headaches later. # find / -name libmilter.a print Build the mini-parts of Sendmail. For example: # cd /usr/local/sendmail/vacation # sh Build If you get the cannot find usr/man/man1/vacation.1 error, just create the directories and copy the vacation.1 file into it. You may see more errors of this type, but we assure you that simply building the directories and copying the file will do the trick. If you want to get fancier, you can go through the sendmail.mc file and specify the correct directory. We learned this after the fact. Repeat this build process for other sub-directories, such as praliases. This helps to prevent the vacation-type errors later. Heres the tricky part. The instructions call for you to find the appropriate pre-made configuration file and build it. We did this using the generic-linux.mc file, but it didnt have enough stuff to make Sendmail operate correctly with Sid-milter. Instead, we prefer the yum method. It wont mess up your libmilter, but it will provide you with the best config file. This will sound illogical, but it works: Go ahead and follow the README instructions for the generic configuration. # cd /usr/local/sendmail/cf/cf # cp generic-linux.mc sendmail.mc # sh Build sendmail.cf # sh Build install-cf Go ahead and do the big build on Sendmail as a whole. # cd /usr/local/sendmail # sh Build install As the build information is passing down the screen, keep an eye out for libmilter to ensure its there. Now add the yum magic: # yum install Sendmail Yum doesnt cause any problems to your current build, but it adds nice config files. Delete the old config files in /etc/mail Go back to sendmail/cf/cf You should have some new files called sendmail.mc.rpmsomething and sendmail.cf.rpmsomething Rename the files so that .rpmsomething is gone # mv sendmail.mc.rpmsomthing sendmail.mc # mv sendmail.cf.rpmsomething sendmail.cf You need to change the sendmail.mc file so that it will work with the milter: Add these two lines to the end of the file: # gedit sendmail.mc type: INPUT_MAIL_FILTER(`sid-filter, `S=inet:xxxx@localhost) define(`confINPUT_MAIL_FILTERS, `sid-filter) Special notes: xxxx refers to the port number of your choice. This will be where sid-filter connects with Sendmail. Be sure to choose a port not associated with another service. We chose 8891. Notice the parameters begin with ` (back tick) and end with (single quote). If you plan to have your mail sent to and from other machines, then you need to make three more modifications to this file. Find dnlTRUST_AUTH_MECH(`digest-md-5 cram-md-5 Login plain)dnl Remove the dnl from the beginning so that the line is not ignored. Find dnldefine(confAUTH_MECHANISMS, `DIGEST-MD-5PLAIN)dnl Remove the dnl from the beginning so that the line is not ignored. Find DAEMON_OPTIONS(`Port=smtp, Addr=127.0.0.1, Name=MTA)dnl Add dnl to the beginning of this line so that Sendmail listens for external connections. Rebuild the modified configuration file: # cd /usr/local/sendmail/cf/cf # sh Build sendmail.cf # sh Build install-cf Now, you are ready for the final build. # cd usr/local/Sendmail # sh Build c # sh Build install Sendmail should be ready to use # service sendmail start Send a test message to yourself create a text file named test send the file to yourself # mail root < test Check for the message # mail You should see the message Type the message number to read it Another great reference for installing and configuring Sendmail is the Linux Home Networking site. Please see the references section. 2.2 The Berkeley Database Installation If you plan to use the Sendmail features that require use of a database, such as creating virtual user accounts with virtusertable.db, then you may want to install the Berkeley Database. This section is optional, and there may be other packages available to accomplish these tasks. Download the Berkeley Database from:  HYPERLINK "http://www.sleepycat.com/products/db.shtml" http://www.sleepycat.com/products/db.shtml Extract the package (we extracted to the desktop). Load the instructions from the docs folder into your browser. Index.html is the start page. Click on the Building for Unix/Posix systems link. Follow the instructions listed: Change to the build_unix directory # cd /root/Desktop/BerkeleyDB-4.3.28.NC/build_unix # ../dist/configure # make # make install Now that the database is installed, you need to change the Sendmail configuration to work with the database. Change to your Sendmail directory # cd /usr/local/sendmail/devtools/Site Create a new site.config.m4 file # gedit site.config.m4 Add the following lines: APPENDDEF(`confINCDIRS', `-I/usr/local/BerkeleyDB.4.3/include') APPENDDEF(`confLIBDIRS', `-L/usr/local/BerkeleyDB.4.3/lib') Save the new file You need to rebuild Sendmail to add database support. Change to the source directory # cd ../.. sh Build c sh Build install If you receive error messages, check the name and location of the database files as specified in the lines you added to site.config.m4. You now have database support for special mail server features. 2.3 Sid-milter Installation Download Sid-milter 0.2.9 from:  HYPERLINK "http://sourceforge.net/project/showfiles.php?group_id=112121" http://sourceforge.net/project/showfiles.php?group_id=112121 Extract to /usr/local This release has a coding error, so you will need to modify the ar.c source file before building it. # cd /usr/local/sid-milter/libar # gedit ar.c Go to line 1041 Change ar_res_init() to res_init() Save ar.c The sid-milter is ready to build: First, build the subdirectory of sid-filter. This should help to prevent the cannot find usr/man/man8/makemap.8 error. If you still get this error, or similar errors make the necessary directories or edit the configuration files as discussed above in section 8.c. # cd /usr/local/sid-milter/sid-filter # sh Build Now, youre ready to build the entire milter # cd /usr/local/sid-milter # sh Build # sh Build install 2.4 Using Sid-filter with Sendmail Before starting sid-filter, stop your Sendmail service. # service sendmail stop Using sid-filter is relatively easy. There are a few options you can specify when running it. l creates a logfile p sets the port. Use the port you specified in the Sendmail configuration files. t allows you to run the filter in test mode so that rejected emails are still received. r lets you set an operating level that specifies how strict you want the filter to be: 0 is the default. It accepts all email. 1 - reject the email if both tests fail (sender-id and spf). 2 - reject the email if one test fails. 3 - reject the email unless one test passes. 4 - reject the email unless both tests pass. An example: # sid-filter l r 4 p inet:8891@localhost In this example, we enabled logging, set the level to the most stringent, and set the port as 8891. For more information about these options and other options, please read the man page. Start Sendmail # service sendmail start You can check that the filter is working by sending yourself an email. The sid-filter header should appear in the header section of the email. 2.5 Using Sendmail with an MX Record As a short note, we added an MX record for our domain and tested it with Sid-filter. We added the MX record to sewpsc.sewp.nasa.gov. The record listed the mail server as callisto.sewpsc.sewp.nasa.gov. We then used the virtual user table to create an alias for the root account of the sewpsc.sewp.nasa.gov domain. To do this, we added to our DNS record that callisto was the mail server and gave it the highest level of priority. To create a working account for root@sewpsc.sewp.nasa.gov, we added the address to the virtusertable file in /etc/mail on the callisto box. We then had to convert the file to a database which can be read by Sendmail. This is an instance in which the Berkeley Database would be helpful. # cd /etc/mail # gedit virtusertable Add the email address and the local account to which the mail should be send and save the file. root@sewpsc.sewp.nasa.gov root Build the database from the file # makemap hash virtusertable < virtusertable 3 SPF Records Sender-ID requires the use of SPF records in DNS. An SPF record is a DNS record of the type text (TXT). The general type TXT allows any information to be added about a particular domain. A TXT record that is being used as an SPF record requires a particular format so that it can be parsed correctly. An SPF record includes the following: TypeDescriptionExamplesVersionVersion of SPF being used.v=spf1, v=spf2.0ScopeTells Sender ID if the record matches PRA, mail-from address or both. If version 2 is designated, then scope must be present.v=spf2.0/mfrom,praMechanismsMechanisms describe the set of hosts designated to send email. They are evaluated from left to right. The evaluation results in one of three options: match, not match, or exception. a:example.com ip4:127.0.0.1 mxModifiersKey-value pairs providing additional information that affect evaluation. Always contains an = sign.redirect=_example.comPrefixesWork with mechanisms to designate whether an IP address should pass or fail. If not designated, then + is implied.+all ~all Types of Mechanisms: MechanismDescriptionallMatches all local and remote IPs and goes to the end of the SPF record. Example:v=spf1 +allincludeSpecifies other domains that are authorized domains. Example:v=spf1 include:domain.com -allaSpecifies all IPs in the DNS A record. Example: v=spf1 a:domain.com -allmxSpecifies all A records for each host's MX record. Example: v=spf1 mx mx:domain.com -allptrSpecifies all A records for each host's PTR record. Example: v=spf1 ptr:domain.com -allip4Specifies a single IP or an acceptable IP address range. /32 is assumed if no prefix-length is included. (ip6 also works ip6:). Example:v=spf1 ip4:192.168.0.1/16 all existsSpecifies one or more domains normally singled out as exceptions to the SPF definitions. An A query is performed on the provided domain, if a result is found a match occurs. Example:v=spf1 exists:domain.com -all The Meaning of Prefixes: PrefixesDescription+Pass. The address passed the test. This is the default if not specified. Example:v=spf1 +all-Fail. The address failed the test. Example:v=spf1 -all~Softfail. The address failed the test, but the result is not definitive. Example:v=spf1 ~all?Neutral. The address did not pass or fail the test. Example:v=spf1 ?all 3.1 Examples v=spf1 mx ip4:192.168.100.136 all This example shows that we are using SPF version 1, we are testing the MX record for the domain in order of MX priority, and only the listed IP address is permitted to send email from the domain. v=spf1 a:example.com all This example again shows the use of SPF version 1, and it tests the A records for the domain are tested. The -all means that no other domains are permitted. v=spf1 ip4:192.168.0.1/16 all This example also uses SPF version1. It uses CIDR notation and permits any IP address between 192.168.0.1 and 192.168.255.255. v=spf1 include:example.net all This example again shows SPF version 1. The include mechanism allows you to cover other domains. This is good for situation where you use example.net, example.cc, and example.com. In this case, the other domain is checked for a match. v=spf2.0/pra mx ip4:122.654.100.2 ~all This example uses SPF version 2, which must provide the scope. In this case, the scope is to only check the PRA. It checks the MX record and allows this one IP address. The tilde indicates that it is not known whether other permitted addresses exist, and it results in a soft-fail if an IP address does not match. v=spf1 +all This example uses SPF version 1. It accepts all IP addresses. This example is not recommended for use. v=spf1 all This example also uses SPF version 1. This domain is not permitted to send mail. 4 Our Evaluation of Sender ID Using Sendmail with Sid-filter We performed a lot of testing on Sender ID after actually getting everything installed and configured correctly. These tests ranged from regular usage to spoofing to checking the effect on our DNS server. We created a fairly simple test network of five computers. Four of the boxes were mail servers, and one box was the domain controller, which ran the DNS using Windows Server 2003. Each computer was a Dell Optiplex Pentium 3 at 933mhz with 256 MB RAM, except for the domain controller. The mail servers all ran on Fedora Core 4. We installed Sendmail 8.13.4 on each of them. We installed Sid-milter 0.2.9 to work with Sendmail as the Sender ID filter. The mail servers were named Callisto, Europa, Ganymede, and Io. The test network was blocked from sending and receiving email from outside the network. 4.1 Basic Testing Sender ID We created many types of SPF records in DNS and tested all four running levels of Sid-filter to determine whether emails would be accepted. Our test network consisted of four identical machines running Linux with Sendmail and Sid-filter. The box called Callisto was designated as the sender, and its domain had an SPF record that was modified for each test. The other three machines were used receivers and were set to run levels 1-4 on the Sid-filter. Sid-filter behaved as expected. The fail result from the filter caused Sendmail to reject the message at all levels, whereas a soft-fail only caused Sendmail to reject the message at the run levels 3 and 4. Summary of Results: SPF RecordRunning Level ResultsAuthentication Headerr=1r=2r=3r=4v=spf1 mx a:io.sewpsc.sewp.nasa.gov ~aacceptacceptrejectrejectsoft-failv=spf1 mx a:io.sewpsc.sewp.nasa.gov -arejectrejectrejectrejectfailv=spf1 mx ip4:177.28.31.66 ~allacceptacceptrejectrejectsoft-failv=spf1 mx ip4:177.28.31.66 -allrejectrejectrejectrejectfailv=spf1 mx a:callisto ~aacceptacceptrejectrejectsoft-failv=spf1 mx a:callisto -arejectrejectrejectrejectfailv=spf1 mx ip4:192.168.100.136 ~allacceptacceptacceptacceptpassv=spf1 mx ip4:192.168.100.136 -allacceptacceptacceptacceptpassv=spf1a:callisto.sewpsc.sewp.nasa.gov ~allacceptacceptacceptacceptpassv=spf1a:callisto.sewpsc.sewp.nasa.gov -allacceptacceptacceptacceptPassv=spf2.0/pra ip4:192.168.100.136 -allacceptacceptrejectrejectneutralV=spf2.0/mfrom ip4:192.168.100.136 allacceptacceptrejectrejectneutralV=spf2.0/mfrom,pra ip4:192.168.100.136 allacceptacceptrejectrejectneutralV=spf2.0/mfrom,pra ip4:192.168.100.136 ~allacceptacceptrejectrejectneutral Notes: The sending machine was called Callisto, and it has an IP address of 192.168.100.136. The IP address 177.28.31.66 was arbitrarily made up. If no MX record is found, Sender ID defaults to the SPF record of the senders domain. Thus, using mx as a mechanism will not affect the outcome if no MX record is present. The sender was not Io. 4.2 The Effect of Sender ID on DNS According to internet drafts describing Sender ID, it is highly dependent and reliant on the steady supply of requests and answers generated by the DNS server. In fact, any interruption or disruption of this relationship with DNS will stop Sender ID from functioning correctly. Specifically, the check_host() process in the Sid-filter sends UDP packets to the DNS to perform its tasks. Our interest was to monitor and study Sender IDs communication exchange to and from the DNS server. We used a Bash shell script to flood the DNS with Sender ID requests. We measured the effect of the requests using the performance monitoring tool that accompanies MS Server and delay indicator shown in the maillog. First, we focused on the Total Response Sent Per Second and Total Query Received Per Second as monitored through our Windows DNS server. Second, we looked at the patterns of individual mail delays as generated in the mail-log (/var/log/maillog). Each run of the test raised the number of emails per pack and was repeated three times. The numbers were averaged to produce the final result. The email delays were sporadic but followed a trend of increasing time delay, as well as an increase in the number of delayed emails. For the batch of 200 emails, there were 19 delays with a maximum time of 24 seconds. Both the Total Response Send/Sec and Total Query Received/Sec achieve a performance plateau beginning with 30 emails per batch at around 350 messages per second. Our theory is that this peak will be maintained as mail volume increases which will cause the DNS to process at this peak for a greater sustained period of time. In conclusion, we do not believe that the DNS will be a significant bottleneck for Sender ID. DNS was designed to perform quick lookups and adding the Sender ID traffic did not seem to pose a threat to its performance capabilities. Number of EmailsTotal Response Send/SecTotal Query Received/SecMax Delay12725.30233.24385123.991.1810193.8152.2815258.2224.4820319.3322.2830330.8331.9840319.5337.5850337.6339.216100356.234216200360.5351.824  4.3 Forgery and Spoofing Tests We made several attempts to spoof emails to test how well Sender ID does what it claims. Our first attempt involved a straightforward spoofing attempt using # sendmail bs which allowed us to open an interactive SMTP session. We set the receiving machine to a Sid-filter run level of 2. We created an SPF record for the spoofed machine that permitted only the IP address for that box. We sent the message from a third box using the interactive mode. The receiving machine properly rejected the message as a forgery. Here is the interactive SMTP session: [root@ganymede ~]# sendmail -bs 220 ganymede.sewpsc.sewp.nasa.gov ESMTP Sendmail 8.13.4/8.13.4/Submit; Wed, 31 Aug 2005 14:37:11 -0400 HELO localhost 250 ganymede.sewpsc.sewp.nasa.gov Hello root@localhost, pleased to meet you MAIL from: 250 2.1.0 ... Sender ok RCPT to: 250 2.1.5 ... Recipient ok DATA 354 Enter mail, end with "." on a line by itself from: root@callisto.sewpsc.sewp.nasa.gov to: root@io.sewpsc.sewp.nasa.gov subject: hi Tricked! . 250 2.0.0 j7VIbB6B025821 Message accepted for delivery QUIT 221 2.0.0 ganymede.sewpsc.sewp.nasa.gov closing connection Here are the Sid-filter results from the Maillog: Aug 31 14:39:03 io sendmail[9578]: j7VId3AC009578: from=, size=620, class=0, nrcpts=1, msgid=<200508311837.j7VIbB6B025821@ganymede.sewpsc.sewp.nasa.gov>, proto=ESMTP, daemon=MTA, relay=ias1.sewpsc.sewp.nasa.gov [192.168.100.138] Aug 31 14:39:03 io sendmail[9578]: j7VId3AC009578: Milter insert (1): header: Authentication-Results: io.sewpsc.sewp.nasa.gov from=root@callisto.sewpsc.sewp.nasa.gov; sender-id=fail (NotPermitted); spf=fail (NotPermitted) Aug 31 14:39:03 io sendmail[9578]: j7VId3AC009578: Milter: data, reject=554 5.7.1 Command rejected Aug 31 14:39:03 io sendmail[9578]: j7VId3AC009578: to=, delay=00:00:00, pri=30620, stat=Command rejected Next, we decided to test an obvious spoof of a message allegedly from Hotmail, since Hotmail has already implemented Sender ID, and it has an active SPF record. The message was sent using # sendmail bs. The message claimed to be from heather11@hotmail.com, which was chosen randomly. The receiving machine caught the message as a forgery and added soft-fail to the authentication header because the SPF record ended in ~all. If the receiving machine had been using a higher run level, then it would have rejected the message. Therefore, Sender ID seems to have accomplished its most basic objectives in the prevention of forged email. 4.3.1 Forging Return Addresses for Bounced Messages Spammers have recently begun using the return address as a means to get spam sent through filters. Basically, spammers insert the intended recipients address into the MAIL-FROM and REPLY-TO fields, and then send the message to a non-existent email account. The email then bounces back to the intended recipient. Ideally, Sender ID should reject these messages because the MAIL-FROM and PRA domains do not authorize the sending IP address. We tested the Sender ID against the bounced spam technique, and it failed to reject the incoming bounced messages. Again, we used # sendmail bs for an interactive SMTP session. The sending machine Europa sent the message to a non-existent user toto on another machine called Ganymede. The MAIL-from:, from:, and reply-to fields were set as root@sewpsc.sewp.nasa.gov. The record for sewpsc.sewp.nasa.gov had an MX record listing Callisto as the mail server. The SPF record for Callisto only authorized Callistos IP address. Likewise, the other machines in the test also only permitted mail from their own IP address. The authentication header on the bounced emailed was sender-id=pass. Here is the interactive SMTP session: [root@europa log]# sendmail -bs 220 europa.sewpsc.sewp.nasa.gov ESMTP Sendmail 8.13.4/8.13.4/Submit; Thu, 1 Sep 2005 15:04:11 -0400 HELO localhost 250 europa.sewpsc.sewp.nasa.gov Hello root@localhost, pleased to meet you MAIL from: 250 2.1.0 ... Sender ok RCPT to: 250 2.1.5 ... Recipient ok DATA 354 Enter mail, end with "." on a line by itself from: root@sewpsc.sewp.nasa.gov reply-to: root@sewpsc.sewp.nasa.gov to: toto@ganymede.sewpsc.sewp.nasa.gov hi hi . 250 2.0.0 j81J4BwB020615 Message accepted for delivery QUIT 221 2.0.0 europa.sewpsc.sewp.nasa.gov closing connection The Sid-filter results for the bounced message based on the Maillog: Sep 1 15:03:43 callisto sendmail[31180]: j81J3htW031180: from=<>, size=2553, class=0, nrcpts=1, msgid=<200509011906.j81J66Cx020634@europa.sewpsc.sewp.nasa.gov>, proto=ESMTP, daemon=MTA, relay=europa.sewpsc.sewp.nasa.gov [192.168.100.143] Sep 1 15:03:43 callisto sendmail[31180]: j81J3htW031180: Milter insert (1): header: Authentication-Results: callisto.sewpsc.sewp.nasa.gov from=MAILER-DAEMON@europa.sewpsc.sewp.nasa.gov; sender-id=pass Sep 1 15:03:43 callisto sendmail[31182]: j81J3htW031180: to=, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=32911, dsn=2.0.0, stat=Sent Interestingly, if the message is instead sent to a fictitious address at Callisto, then only the SPF part of Sender ID returns a fail result. [root@europa log]# sendmail -bs 220 europa.sewpsc.sewp.nasa.gov ESMTP Sendmail 8.13.4/8.13.4/Submit; Thu, 1 Sep 2005 15:41:13 -0400 HELO localhost 250 europa.sewpsc.sewp.nasa.gov Hello root@localhost, pleased to meet you MAIL from: 250 2.1.0 ... Sender ok RCPT to: 250 2.1.5 ... Recipient ok DATA 354 Enter mail, end with "." on a line by itself from: root@callisto.sewpsc.sewp.nasa.gov reply-to: root@callisto.sewpsc.sewp.nasa.gov to: toto@callisto.sewpsc.sewp.nasa.gov subject: hi this is a test from Europa. . 250 2.0.0 j81JfDHE020962 Message accepted for delivery QUIT 221 2.0.0 europa.sewpsc.sewp.nasa.gov closing connection Here are the authentication header results: From MAILER-DAEMON@callisto.sewpsc.sewp.nasa.gov Thu Sep 1 15:40:57 2005 Authentication-Results: callisto.sewpsc.sewp.nasa.gov from=MAILER-DAEMON@europa.sewpsc.sewp.nasa.gov; sender-id=pass; spf=fail (NotPermitted) In this instance, the message was rejected at a run level four. 4.4 An Interesting Quirk An interesting problem we encountered was that emails sent and received on the same box resulted in a fail status and were rejected depending upon the run level. The problem is that internal mail never uses an external IP address, so when Sid-filter checks the SPF record, it determines that 127.0.0.1 does not match the record. We discovered that adding the IP address of localhost 127.0.0.1 to the SPF record worked as a temporary fix. The correct solution is to start Sid-filter with the P option for peerlist. A peerlist is a list of IP addresses that you choose to exclude from being checked by the filter. You just need to create a list in a file and tell Sid-filter where it is located. Once we added localhost to this file, then the strange rejections ended. An example: #sid-filter l r 4 P /test/peerlist p inet:8891@localhost 5 Limitations of Sender ID Sender ID is not a silver bullet that will eliminate spam. It is simply another tool that will work with other anti-spam technologies to reduce the amount of spam and instances of forgery and phishing. Sender ID is not a complete solution to the problem of spam. For example, a spammer who uses a valid SPF record can still send spam that will not be stopped by Sender ID. On the other hand, it is extremely helpful in the prevention of phishing scams because a spammer cannot easily send forged emails purportedly from your bank asking for personal data, assuming your bank posts an SPF record in DNS. Sender ID is not a perfect anti-spam tool, and it has been criticized for several reasons. A primary criticism of Sender ID is that it will generate many false positives and discard valid email because many messages are received from IP addresses that are not authorized by the sender. For example, mail that is automatically forwarded from one server to another is currently rejected by Sender ID. A concrete example of mail forwarding is when you change email addresses. You may want the old address to forward mail to your new address until everyone you know has been notified of the change. We tested this Sender ID problem by adding a .forward file in the /home directory of a user on one of our boxes. The receiving server rejected the email because the domain of the original sender A did not match the IP address of the forwarding sender B. A solution called Sender Re-writing Scheme (SRS) has been proposed, which would require the forwarding box to replace both sender fields with its email address. However, this would require an implementation change for all mail servers. Moreover, bounced messages would not be returned to the original sender. Finally, it could introduce more fraud into the system by allowing an email header to be changed in transit. Another major criticism of Sender ID is that it is only as secure as DNS because it was built upon DNS. DNS was originally designed for simplicity and efficiency. Therefore, DNS has no inherent security features and can be exploited. For example, attackers can pose as the local DNS server and respond to requests with forged records, which would affect Sender ID. Additionally, a resourceful attacker could fake the IP address by hijacking the address space. An attacker can alter the IP router structure if the attacker has access to a router that is involved with external BGP routing. The attacker could then advertise a more specific route to a rogue SMTP client and override the legitimate owner of the address. Therefore, the results of a Sender ID lookup may be vulnerable to DNS exploits. Another criticism is that Sender ID only authenticates the domain and not the actual sender. Thus, it is still possible to forge an internal address. For example, if bob@example.com pretends to be alice@example.com, then Sender ID will not catch the forgery. Bob would still be sending the message from an authorized IP address for example.com. Sender ID has also been criticized because it does not block self-replicating email viruses. When a virus sends email to every person in an address book, the messages will be accepted by the receiver because Sender ID just matches domain name to allowed server IP addresses. Thus, email sent by viruses would appear to be legitimate and would be accepted by Sender ID. A final criticism of Sender ID of Sender ID is that you must trust all other domain owners to keep a valid and updated SPF record. To prevent frustration and hassle, many domain owners may just add +all to their SPF records, which would authorize all IP addresses. Authorizing all IP addresses is a tactic that could be used by spammers. Alternatively, legitimate domains that authorize all IP addresses could be targeted by spammers at potential victims of forgery. Domain owners should use SPF records to protect their goodwill and customers against spammers and phishers. Thus, Sender ID is dependent upon the quality of the SPF records. 6 References [1] Advogato.org. Why You Shouldnt Jump on the SPF Bandwagon. January 13, 2005.  HYPERLINK "http://www.advogato.org/article/816.html" http://www.advogato.org/article/816.html. [2] Allman, E. & Katz, H. SMTP Service Extension for Indicating the Responsible Submitter of an E-Mail Message. IETF Internet Draft, May 2005.  HYPERLINK "http://www.ietf.org/internet-drafts/draft-katz-submitter-01.txt" http://www.ietf.org/internet-drafts/draft-katz-submitter-01.txt [3] Ipswitch.com. User Guide: Setting Up and SPF Record. Last Accessed August 29, 2005.  HYPERLINK "http://www.ipswitch.com/support/ics/guides/IMailServer/8_2/IMailUGHTML/Chapter%202%20config12.html" http://www.ipswitch.com/support/ics/guides/IMailServer/8_2/IMailUGHTML/Chapter%202%20config12.html [4] Linuxhomenetworkingguide.com. Chapter 21: Configuring Linux Mail Servers. Last Accessed July 22, 2005.  HYPERLINK "http://www.linuxhomenetworking.com/linux-hn/sendmail.htm" http://www.linuxhomenetworking.com/linux-hn/sendmail.htm. [5] Lyon, J. Purported Responsible Address in E-Mail Messages. IETF Internet Draft, May 2005.  HYPERLINK "http://www.ietf.org/internet-drafts/draft-lyon-senderid-pra-01.txt" http://www.ietf.org/internet-drafts/draft-lyon-senderid-pra-01.txt [6] Lyon, J. & Wong, M. Sender ID: Authenticating E-Mail. IETF Internet Draft, May 2005.  HYPERLINK "http://www.ietf.org/internet-drafts/draft-lyon-senderid-core-01.txt" http://www.ietf.org/internet-drafts/draft-lyon-senderid-core-01.txt. [7] Messaging Anti-Abuse Working Group. Important Considerations for Implementers of SPF and/or Sender ID. July 11, 2005.  HYPERLINK "http://www.maawg.org/about/whitepapers/spf_sendID/" http://www.maawg.org/about/whitepapers/spf_sendID/. [8] Microsoft. Sender ID Framework Deployment Overview. August 25, 2004.  HYPERLINK "http://www.microsoft.com/downloads/details.aspx?familyid=8958AB23-F350-40FE-BA0A-2967B968FD8D%20&displaylang=en" http://www.microsoft.com/downloads/details.aspx?familyid=8958AB23-F350-40FE-BA0A-2967B968FD8D%20&displaylang=en. [9] Microsoft. Sender ID Resources: Tools and Information about the Technology. May 2, 2005.  HYPERLINK "http://www.microsoft.com/mscorp/safety/technologies/senderid/resources.mspx" http://www.microsoft.com/mscorp/safety/technologies/senderid/resources.mspx. [10] Microsoft. Sender ID Framework: Implementation Tips for the Sender ID Framework Creating your SPF record. March 3, 2005.  HYPERLINK "http://download.microsoft.com/download/1/1/8/1184dafa-f1c6-4cd6-8fa1-0b06abbebd79/spf_tips.pdf" http://download.microsoft.com/download/1/1/8/1184dafa-f1c6-4cd6-8fa1-0b06abbebd79/spf_tips.pdf [11] Sourceforge. Project: Sender ID Milter. Last Accessed September 13, 2005.  HYPERLINK "http://sourceforge.net/projects/sid-milter/" http://sourceforge.net/projects/sid-milter/ [12] Wong, M. & Schlitt, W. Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, version 1. IETF Internet Draft, June 6, 2005.  HYPERLINK "http://www.ieft.org/internet-drafts/draft-schlitt-spf-classic-02.txt" http://www.ieft.org/internet-drafts/draft-schlitt-spf-classic-02.txt.     PAGE  PAGE 21  FJKLMOijtv|}ɷucTBB3h D5CJOJQJ^JaJ#hS(hAE5CJOJQJ^JaJhAE5CJOJQJ^JaJ#hS(hl 5CJOJQJ^JaJ#hS(h5CJOJQJ^JaJh5CJOJQJ^JaJh[5CJOJQJ^JaJ#hS(h[5CJOJQJ^JaJ#hS(h""5CJ$OJQJ^JaJ$#hS(h6kc5CJ$OJQJ^JaJ$#hS(h6kc5CJ,OJQJ^JaJ,#hS(h@5CJ,OJQJ^JaJ, GHIJKLMNOaj}~$a$gdl $a$gdt9   $a$gd -D M ]^gdNa$-D M ]^a$gdNa$a$gdNa$a$gdl }   ! " 3 4 K L M g h i j k °zi`R`AR8Rh(mHnHu jh5c,UmHnHujhFGUmHnHuhFGmHnHu!h/khFG5>*^JmHnHuhS(ht^JjhS(htU^JhS(ht5OJQJ^J#hS(h$$45CJOJQJ^JaJ#hS(ht5CJOJQJ^JaJh 5CJOJQJ^JaJhK&OJQJ^JhNaOJQJ^JhNa5OJQJ^JhNa5CJOJQJ^JaJ  ! l m L  W   M #$] $ gdFGgdFG $ $a$gdtk l m + , - G H I J K L r s t ͳͦͳveͳͦv jwh5c,UmHnHuhFGhFG>*mHnHu jh5c,UmHnHu!h/khFG5>*^JmHnHuhFGOJQJmHnHuh(mHnHu j}h5c,UmHnHujhFGUmHnHuh/khFG>*^JmHnHuhFGhFGCJaJhFGmHnHu"      6 7 8 R S T U V W d e f ˻Ს˓ᲂ˓q`!h/khFG5>*^JmHnHu jkh5c,UmHnHu jh5c,UmHnHuhFGhFG>*mHnHu jqh5c,UmHnHuhFGmHnHuh/khFG>*^JmHnHuhFGOJQJmHnHuh(mHnHujhFGUmHnHu jh5c,UmHnHu$     , - . H I J K L M ĴϣᖅtĴc j_h5c,UmHnHu jh5c,UmHnHu!h/khFG5>*^JmHnHuhFGOJQJmHnHu jeh5c,UmHnHuh/khFG>*^JmHnHuhFGhFGCJaJhFGmHnHuh(mHnHujhFGUmHnHu jh5c,UmHnHu"M o p q  !"#$<=>XYZ[\]۴۴wf۴ jSh5c,UmHnHuhFGhFGCJaJ jh5c,UmHnHu jYh5c,UmHnHuh/khFG>*^JmHnHuhFGOJQJmHnHuh(mHnHu jh5c,UmHnHujhFGUmHnHuhFGmHnHuhFGhFG>*mHnHu%]wxy׽׽הvhXHhS(h9i5>*OJQJ^JhS(ht5>*OJQJ^JhS(ht5OJQJ^JhS(htOJQJ^J!jhS(htOJQJU^JhFGOJQJmHnHu jMh5c,UmHnHuhFGhFGCJaJh(mHnHu jh5c,UmHnHujhFGUmHnHuhFGmHnHu!h/khFG5>*^JmHnHu @L  gd%:w@&gdfh^gdI& & Fgd46@&gdddhgdE $ 37_STD^vy[hצצʂuhu[u[uhS(h_TUOJQJ^JhS(hXsOJQJ^JhS(hNOJQJ^JhS(hrOJQJ^JhS(hOJQJ^JhOJQJ^JhS(h|OJQJ^JhS(hs:9OJQJ^JhnupOJQJ^JhS(hlOJQJ^JhS(h4OJQJ^JhS(h9iOJQJ^JhS(hrk5OJQJ^J#%5;EFLM[t   )0;?@Y]^pwxϫµ枔}phS(h:*OJQJ^JhF$OJQJ^JhS(h4OJQJ^Jh_lOJQJ^JhS(h.GOJQJ^JhOJQJ^JhS(hs:9OJQJ^JhS(hhmOJQJ^JhfhOJQJ^JhS(hXsOJQJ^JhS(h@rOJQJ^JhS(h;OJQJ^J, ?@   9Z*+Zm¸{q{gZgZgZgZgZgZgZgZgZgZh%:wh%:wOJQJ^Jh%:wOJQJ^JhfhOJQJ^JhvFOJQJ^JhupiOJQJ^Jhfhh46>*OJQJ^Jhfhhfh>*OJQJ^JhS(h_lOJQJ^JhI&OJQJ^Jh:*OJQJ^JhS(h:*OJQJ^JhS(h46OJQJ^JhS(h-TOJQJ^JhS(h4OJQJ^J#*+45"#R S !!?#@#~&&gdd=@&gdt & F gd & F gd hgd%:w & F gd%:wBC)45wx9:tu"#-qr˾wmhz2OJQJ^JhS(hXOJQJ^JhS(h?DOJQJ^JhS(h(OJQJ^JhS(hl>5>*OJQJ^JhS(ht5>*OJQJ^JhS(hl>OJQJ^Jh2OJQJ^JhOJQJ^Jh hOJQJ^Jh%:wh%:wOJQJ^Jh%:wOJQJ^J( t!y!!!!!!!!!!"""9#@#|#$$$$+%%%%u&|&}&&&&ٿٲ楛掿ttgYhS(ht>*OJQJ^JhS(hc|OJQJ^JhS(h=OJQJ^JhS(h OJQJ^JhS(hkOJQJ^JhF$OJQJ^JhS(hd=OJQJ^JhS(hMOJQJ^JhS(hwOJQJ^JhS(hyOJQJ^JhS(hIvOJQJ^JhS(h'HzOJQJ^JhS(hLOJQJ^J!&&&&'F''''(>(p((((()K)m)x)|*++ & Fgd & FgdP! & FgdP! & FgdR & Fgd  & Fgd @&gd(&&&&&&&&&&'''F'''''''( (p(r((ʽ|o|bX|K|>|b|hS(h!OJQJ^JhS(hQOJQJ^Jhz2OJQJ^JhS(h8+iOJQJ^JhS(h*OJQJ^JhS(h OJQJ^JhS(h@0JOJQJ^J'jhS(h@OJQJU^J!jhS(h@OJQJU^JhS(h@OJQJ^JhS(hnQ>*OJQJ^JhS(h(>*OJQJ^Jh(>*OJQJ^JhS(hk>*OJQJ^J((((((((()K)M)P)Q)\)m)o)))))S*h*|*+7+J+W+[+\++++F,K,,,"-ϵ󵨞󵔵󵞵zm`mmhS(hycOJQJ^JhS(h)OJQJ^JhS(hBOJQJ^JhS(hOJQJ^JheOJQJ^JhOJQJ^JhS(hKOJQJ^JhS(hP!OJQJ^JhS(h?DOJQJ^JhS(hROJQJ^Jhz2OJQJ^JhS(h OJQJ^JhS(h8+iOJQJ^J%+#-n-----.+.>....*/S/m///!0K00 & Fgd} & Fgd8+i & Fgd} & Fgdla0 & Fgdla0 & FgdK & FgdK & FgdP! & Fgd) & FgdR"-#-m-n-p-r-s-t-~------------..#.+.-....//*/S/_//////#0J0K0c00̿浿̨̞̿̿̿̑̄̄ww̵hS(hFBOJQJ^JhS(h}OJQJ^JhS(hla0OJQJ^JhOJQJ^JhS(hJ"OJQJ^JheOJQJ^JhS(hKOJQJ^JhS(h8+iOJQJ^JhS(h)OJQJ^JhS(hP!OJQJ^JhS(hROJQJ^J*00001G1V1 2Y223X3334o44444 5 & Fgdyc & FgdJ" & FgdJ" & Fgdrq & FgdV & FgdV & FgdV & Fgd} & Fgd}0011W2X2Y222344o444444444 55$5&5/5052545e5g5p55556!686D6666̵̵¨ٛ󛇛zmzhS(h:OJQJ^JhS(h@zOJQJ^JhMBOJQJ^JhmOJQJ^JhS(h/{OJQJ^JhS(hJ"OJQJ^JhS(hrqOJQJ^JhOJQJ^JhS(hVOJQJ^JhS(h]OJQJ^JhS(h}OJQJ^JhS(h>hOJQJ^J) 5$525E5e5~5555556!6D6E666666888809 & FgdI}@&gdtgdhCgd@z & Fgdyc & Fgdyc & Fgdyc6666Y7]7f7|777777778888788898:8r8s8t88󜒜xgxSgDhS(hn0JOJQJ^J'j hS(hnOJQJU^J!jhS(hnOJQJU^JhS(hnOJQJ^JhS(hIOJQJ^JhaOJQJ^Jh\zOJQJ^JhS(hI}OJQJ^JhOJQJ^JhS(h<OJQJ^JhS(hiOJQJ^JhS(hhC>*OJQJ^JhS(ht>*OJQJ^JhS(hhCOJQJ^J888888889/9099999999999999999r:Խ|obUԉooKoKh.OJQJ^JhS(hHOJQJ^JhS(hQ_OJQJ^JhS(hs^sOJQJ^JhS(h0;fOJQJ^JhS(hiOJQJ^JhS(heOJQJ^JhS(hnOJQJ^JhS(hBaOJQJ^JhaOJQJ^JhS(hIOJQJ^JhS(hr4OJQJ^JhS(hI}OJQJ^J!jhS(hnOJQJU^J09e999999:r::::: ;L;;;;;; & FgdK. & FgdK. & Fgd9@p^pgd0: & Fgdj: & Fgd< & Fgd< & Fgdr4 & Fgd0;f & Fgd0;f & FgdI}r:::::::::: ;;;;;;<<<<<<<<ܱϊ}p}cVHhS(ht>*OJQJ^JhS(h}OJQJ^JhS(hJ"OJQJ^JhS(h$OJQJ^JhS(h!OJQJ^JhS(h/6<OJQJ^JhS(hK.OJQJ^JhS(h9@OJQJ^J hS(hl@CJOJQJ^JaJhS(hIOJQJ^JhS(hj:OJQJ^JhS(hl@OJQJ^JhaOJQJ^JhS(h<OJQJ^J;<<<<<<<<==%>F>S>c>>>>? & Fgd & Fgd & FgdzQ & Fgd( & Fgd}gdyc@&gdt@ ^@ gd} ^ gd] & Fgd! & Fgd/6< & FgdK.<<<< ====== =j=k=l======>$>%>E>F>>[?̿~qdqWdqdJhS(hOJQJ^JhS(h~OJQJ^JhS(hzQOJQJ^JhS(h(OJQJ^JhS(h!0JOJQJ^J'j hS(h!OJQJU^J!jhS(h!OJQJU^JhS(h!OJQJ^JhS(hycOJQJ^Jh'OJQJ^JhS(hc|OJQJ^JhS(hK>*OJQJ^JhS(hyc>*OJQJ^J[??????@@U@W@[@z@{@*AmBoBpBBBBBBBCCCCDDDFD´Œrrrrrhr[rNhS(h5OJQJ^JhS(h&oOJQJ^JhOJQJ^JhS(h[OJQJ^JhS(hw3OJQJ^JhS(hgOJQJ^JhS(hc|OJQJ^JhS(hB(>*OJQJ^JhS(ht>*OJQJ^JhS(hB(OJQJ^JhS(huCOJQJ^JhS(hOJQJ^Jh'OJQJ^JhS(hA"OJQJ^J???@7@B@U@V@W@z@{@@@*A?AAACBlBBBB & Fgdg & Fgdg & FgdB( & FgdB(@&gdtgdB( & FgduC & FgduC & FgdA"B+C7CdCCD-DFDDDDDDFFGGGGXHwHH & FgdCj & FgdCj@&gdCjgdCj & Fgd~ & Fgd5 & Fgd[ & Fgd[ & FgdgFDDDDDDDDDDEEF2FOFgFpFsFFFFF(G*OJQJ^Jh2OJQJ^JhnOJQJ^JhOVOJQJ^JhI OJQJ^JhFOJQJ^Jh?OJQJ^Jh~OJQJ^Jh6hCj>*OJQJ^JhCj>*OJQJ^JhCjOJQJ^Jh~OJQJ^JhS(h} OJQJ^JhS(h~OJQJ^J"HHHHHHH J J3J8JDJMJ $IfgdS(gdV^@&gd(gd2 & FgdCj HHHHHHAIBIII J JJ"J#J1J2J3JNJJJJKKǺ|o|bTG=G=GhqOJQJ^JhS(h?mOJQJ^JhS(h?m5OJQJ^JhY7'h"$OJQJ^JhY7'hY7'OJQJ^JhY7'hYsOJQJ^Jh' OJQJ^JhS(hYsOJQJ^JhS(hi1OJQJ^JhS(hu->OJQJ^JhS(hXOJQJ^JhS(hc|>*OJQJ^JhS(h(>*OJQJ^Jh(5>*OJQJ^JhS(hV^5>*OJQJ^JMJNJVJqJJLCCC $IfgdS(kd+ $$IflFT$0x  t06    44 lapJJJKKqhhh $IfgdS(kd $$IflFT$0x t06    44 laKKKK'KeKkKKcLdLLLLMMMM&M(M>M?MBMMMMMMMNNNN NŻϤϚvhv^vTv^vTvTvTvh'dXOJQJ^JhS(OJQJ^JhS(hS(5OJQJ^JhS(hS(OJQJ^Jh*OJQJ^JhS(h2OJQJ^Jh"$OJQJ^Jh3ZOJQJ^JhS(h~OJQJ^Jh~OJQJ^JhgpOJQJ^JhS(hqOJQJ^JhS(h?mOJQJ^JhS(ha'OOJQJ^JhqOJQJ^J KK'KKKKLqhhhhh $Ifgd8kdl $$IflFT$0x t06    44 laLL LrLLqhhh $Ifgd8kd $$IflFT$0x t06    44 laLLLM MMqhhhh $Ifgd8kdb$$IflFT$0x t06    44 laMMMM(M2M>Mqlll`` $$Ifa$gdS(gdS(kd$$IflFT$0x t06    44 la>M?MCMMMjaaa $IfgdIkdX$$Ifl0$t  t0644 lapMMMMN{{{ $IfgdIzkd$$Ifl0$t t0644 laNN N1NSN{{{ $IfgdIzkdQ$$Ifl0$t t0644 la N0N1NRNTNVNWNNNNNNNNNOOOOO|OOOOOOOOOOOOwPxPPPPPPPŻŻܮ鮆|rdrh*h*5OJQJ^Jh*OJQJ^Jh2OJQJ^JhOVOJQJ^JhsOJQJ^Jh3ZOJQJ^Jh%3OJQJ^JhS(hsOJQJ^Jh%OJQJ^JhS(h%OJQJ^JhpOJQJ^JhS(hS(OJQJ^Jh'dXOJQJ^JhS(h'dXOJQJ^J'SNTNWNNN{{{ $IfgdIzkd$$Ifl0$t t0644 laNNNNO{{{ $IfgdIzkd$$Ifl0$t t0644 laOOOOO{{{ $IfgdIzkd$$Ifl0$t t0644 laOOOxPP{{{ $IfgdIzkd$$Ifl0$t t0644 laPPPPPPPss $$Ifa$gd*gdS(zkdJ$$Ifl0$t t0644 laPPPQ1Qjaaa $Ifgd*kd$$Ifl0$t  t0644 lapPPQQ0Q4QWQXQkQoQQQRRRRR(RRRRRRRRSS)S*SdSSSSSSS)Tǽ~t~tghiJh%3OJQJ^Jh%3OJQJ^Jh%3h%3OJQJ^Jh+4OJQJ^JhgpOJQJ^Jh$OJQJ^Jh;,OJQJ^Jh ;OJQJ^JhS?(OJQJ^JhS?(hS?(>*OJQJ^Jh@^OJQJ^Jh*OJQJ^JhOJQJ^Jh*h*OJQJ^J$1Q2Q4QXQlQ{{{ $Ifgd*zkdC$$Ifl0$t t0644 lalQmQoQQ{{ $Ifgd*zkd$$Ifl0$t t0644 laQQQRR{{{ $Ifgd*zkd$$Ifl0$t t0644 laRRRR(R)RLRS*SSztzldl\ & Fgdgp & FgdS?( & FgdS?(@&gdS?(gdS?(gd*zkd`$$Ifl0$t t0644 la SSiTTwUUVVPW\WWWWWWWXX%[&['[gd@^@&gdt^gdP!gdS?(gd%3 & Fgd  & Fgd  & FgdRm= & FgdiJ & FgdiJ & Fgd%3)T0ThTTTT>UvUwUxUUUqVrVVWWWWWWWWWٻϱyiYL?YhY5>*OJQJ^JhvY5>*OJQJ^JhS(hw5>*OJQJ^JhS(hF 5>*OJQJ^JhS(hVoOJQJ^JhS(hS?(OJQJ^Jh%3OJQJ^Jh OJQJ^JhOVOJQJ^JhRm=OJQJ^JhFMOJQJ^JhwOJQJ^JhiJOJQJ^JhiJhiJOJQJ^JhiJh%3OJQJ^JhiJhzOJQJ^JWWWXXXXXXXXXXXuYYYYYYYYYZSZYZZZZZ"[#[%[&['[Ⱦձ||rh^^hb#!OJQJ^JhCnOJQJ^Jhes[OJQJ^JhS(h@@OJQJ^Jh@@OJQJ^JhAOJQJ^Jh.OJQJ^JhkOJQJ^JhS(h,!OJQJ^Jh(}OJQJ^JhS(h{|OJQJ^JhS(hOJQJ^JhS(h>*OJQJ^JhS(h@^5>*OJQJ^J#'[)[9[C[D[[2\7\p\\\\\\\ ] ] ],]]]]]] ^^+^,^ǽǕwj]jUhlr,CJaJh( 5OJQJ\^Jhlr,5OJQJ\^JhkOJQJ^Jh!MOJQJ^JhCXAOJQJ^Jht^OJQJ^JhDCOJQJ^Jh4MOJQJ^JhzOJQJ^JhOJQJ^Jhg\OJQJ^JhVoOJQJ^Jhkhk>*OJQJ^Jh(>*OJQJ^JhCz%>*OJQJ^J'[C[D[]]]]^+^ $$Ifa$gdlr,gd@^@&gdk+^,^.^2^6^:^>^JD;;;; $$Ifa$$Ifkd$$IfTlJF&&;&&h 0    44 lapT>^@^$If,^@^A^L^M^O^d^^^^^^^^__`_a_____``^`b`c`d`````````````````@aGaHaIaah.kCJaJh;CJOJQJ^JaJh.kCJOJQJ^JaJh( CJaJh^pCJOJQJ^JaJh( CJOJQJ^JaJhW}sCJOJQJ^JaJh$CJOJQJ^JaJhlr,CJaJhlr,CJOJQJ^JaJ0@^A^kd$$IfTlֈ&';'''''h044 lap<TA^h^o^v^}^^^ $$Ifa$gdlr,$If^^kd$$IfTlֈ&';'''''h044 lap<T^^^^^^^ $$Ifa$gdlr,$If^^kd$$IfTlֈ&';'''''h044 lap<T^^^_ ___ $$Ifa$gdlr,$If__kd$$IfTlֈ&';'''''h044 lap<T_?_F_M_T_[_`_ $$Ifa$gdlr,$If`_a_kd$$IfTlֈ&';'''''h044 lap<Ta_y______ $$Ifa$gdlr,$If__kd$$IfTlֈ&';'''''h044 lap<T_______ $$Ifa$gdlr,$If__kd$$IfTlֈ&';'''''h044 lap<T__` ```` $$Ifa$gdlr,$If``kd$$IfTlֈ&';'''''h044 lap<T`B`I`P`W`^`c` $$Ifa$gdlr,$Ifc`d`kd $$IfTlֈ&';'''''h044 lap<Td``````` $$Ifa$gdlr,$If``kd$$IfTlֈ&';'''''h044 lap<T``````` $$Ifa$gdlr,$If``kd! $$IfTlֈ&';'''''h044 lap<T`$a+a2a9a@aHa $$Ifa$gdlr,$IfHaIakd+!$$IfTlֈ&';'''''h044 lap<TIaqaxaaaaa $$Ifa$gdlr,$Ifaaaaaaaaaabb7b8b9b=b>bAbBbbbbb򵤖o^o^oM<^ hhBCJOJQJ^JaJ hhkCJOJQJ^JaJ hh#0CJOJQJ^JaJ hh?CJOJQJ^JaJhhCJOJQJ^JaJh CCJaJh CCJOJQJ^JaJ hh CCJOJQJ^JaJhCJaJh CCJOJQJ^JaJ hhCJOJQJ^JaJh;CJaJh;CJOJQJ^JaJhCJOJQJ^JaJaakd5"$$IfTlֈ&';'''''h044 lap<Taaaaaaa $$Ifa$gdlr,$Ifaakd?#$$IfTlֈ&';'''''h044 lap<Tabb!b(b/b7b $$Ifa$gdlr,$If7b8bkdI$$$IfTlֈ&';'''''h044 lap<T8b9bBbbb}ccccccffhh3j4jk k!k2kJkckmk $$Ifa$gd(gdVo@&gdt & F gd#0gd@^bb}cccccccccccccd=dddddd*OJQJ^JhS(hF >*OJQJ^Jhk>*OJQJ^JhS(hP8OJQJ^JhVoOJQJ^J hh( CJOJQJ^JaJh( CJOJQJ^JaJh)oCJOJQJ^JaJh#0CJOJQJ^JaJeeffffffgggwgggghhh8h9hThyhhhhhhwiiiiFjjjkkk k!kmk,l-l.lȾߧߧߧߧߝ߂q!j=/hS(hVoOJQJU^Jh(hVo5OJQJ^JhS(hTNOJQJ^JhVoOJQJ^JhMOJQJ^JhjYMhVoOJQJ^Jh|fOJQJ^JhjYMOJQJ^JhS(hROJQJ^JhS(hVoOJQJ^Jh2OJQJ^JhRyOJQJ^J*mknkpksk, $$Ifa$gd(kdS%$$IfTl\:t"&&&& (044 lalp(Tskxkzk{k}kkk;kdX&$$IfTl\:t"''''044 lalp(T $$Ifa$gd(kkkkkkk;kd''$$IfTl\:t"''''044 lalp(T $$Ifa$gd(kkkkkkG;;;; $$Ifa$gd(kd'$$IfTl\:t"''''044 lalp(TkkkkkkG;;;; $$Ifa$gd(kd($$IfTl\:t"''''044 lalp(TkkkkkkG;;;; $$Ifa$gd(kd)$$IfTl\:t"''''044 lalp(TkkkkkkG;;;; $$Ifa$gd(kdc*$$IfTl\:t"''''044 lalp(TkkkkkkG;;;; $$Ifa$gd(kd2+$$IfTl\:t"''''044 lalp(TkkkkllG;;;; $$Ifa$gd(kd,$$IfTl\:t"''''044 lalp(Tll llllG;;;; $$Ifa$gd(kd,$$IfTl\:t"''''044 lalp(Tlll!l'l*lG;;;; $$Ifa$gd(kd-$$IfTl\:t"''''044 lalp(T*l+l,l.l/l0lGB9B4gdW1^gdVogdVokdn.$$IfTl\:t"''''044 lalp(T.l/l0lNlOlPlyl|llllllllll m'm+m4mmmmmnZn[n\nnpŻ|||||rh|Yh SEh SECJOJQJaJh*1OJQJ^JhOJQJ^Jh SEOJQJ^Jhu)OJQJ^JhvOJQJ^JhjOJQJ^Jhjh^ytOJQJ^JhV7OJQJ^Jh^ytOJQJ^Jh^yt>*OJQJ^JhVo>*OJQJ^JhA8XhA8X>*OJQJ^JhS(hW1OJQJ^JhA8XOJQJ^J0lOlPl[n\nnn@qAqsqtqEtFtvvwwxx{{{{p~q~~~@&gdogdVogdo@&gdA8Xpp?qAq`qqqsqtqrrrZsDtEtFttttttttuuvv\v^vivvvvuuhuh^ThaWOJQJ^JhvOJQJ^JhV7htlOJQJ^Jh1aOJQJ^JhV7ht{OJQJ^JhV7hrOJQJ^JhV7h/hOJQJ^Jh/hCJOJQJaJh SEh SE5CJOJQJaJh8Th SE5CJOJQJaJhY]OJQJh SEh SEOJQJh SEh SECJOJQJaJh SECJOJQJaJvvvvvvvwwwwwwww;xxxxy1y2y5yGyyƸwmcYOEOhXoKOJQJ^JhOJQJ^Jh]IOJQJ^JhL9OJQJ^JhOJQJ^Jh SEOJQJ^Jh1\OJQJ^JhMOJQJ^Jh2itOJQJ^Jh/hhTOJQJhV7hT>*OJQJ^JhV7h}Ia>*OJQJ^JhV7hL9>*OJQJ^JhtlOJQJhV7h/hOJQJ^JhV7htlOJQJ^Jh@QOJQJ^Jyyzz>z@zRzgzzz+{:{;{n{q{y{z{{{{{{{o~p~q~u~~~~~pΰΡΰΰΰseh2itCJOJQJ^JaJhY]hY]5CJOJQJaJhY]hY]CJOJQJaJhE}hY]CJOJQJaJhE}hE}CJOJQJaJhY]OJQJ^JhL9OJQJ^JhG3sOJQJ^JhE}OJQJ^JhvOJQJ^Jh,<OJQJ^JhOJQJ^Jh1EOJQJ^J".0nopqHIgdF @&gdF @&gd@&gdNgdVoM_qvn.˽r`QB8h<OJQJ^Jh<5CJOJQJ^JaJhH5CJOJQJ^JaJ#hHhH5CJOJQJ^JaJ hHhHCJOJQJ^JaJhHCJOJQJ^JaJhHhHOJQJ^Jh/CJOJQJ^JaJ hHhstCJOJQJ^JaJh,<CJOJQJ^JaJhstOJQJ^JhyOJQJ^Jh,<OJQJ^Jh;?FOJQJ^JhsthstOJQJ^J+Tq -npq04HQ-3Zƻߣxh[Q[GQ[Q[h~<OJQJ^JhV OJQJ^JhS(hF OJQJ^JhS(hF 5>*OJQJ^JhS(hP0OJQJ^Jh6OJQJ^Jhv<OJQJ^JhG3sOJQJ^Jh06tOJQJ^JhshN>*OJQJ^Jhs>*OJQJ^Jh>*OJQJ^Jhshs>*OJQJ^JhsOJQJ^JhA8XOJQJ^Jh<h<OJQJ^JZ>?JQV_zGHq˷ˠˌ˂ueUhS(h"r5>*OJQJ^JhS(hF 5>*OJQJ^JhS(h[OJQJ^JhfOJQJ^JhPOJQJ^Jh[&=OJQJ^Jh[&=hF OJQJ^Jh~OJQJ^JhF OJQJ^JhWOJQJ^JhS(hF OJQJ^Jh~<OJQJ^Jh%OJQJ^JhG3sOJQJ^JhE-OJQJ^JnopqMNxygd~<gdQgdx4@&gdtgd@^gdVo^gdF gdF ә !"JKMPRiĚ5Ϳ͚ͮځtf[fPft?t!jhS(h~<OJQJU^Jh~<6OJQJ^JhQ6OJQJ^JhLh~<6OJQJ^JhS(h~<OJQJ^JhQOJQJ^JhS(hx40JOJQJ^J'j;hS(hx4OJQJU^J!jhS(hx4OJQJU^JhLhx46OJQJ^JhS(hx4OJQJ^Jhx4OJQJ^JhS(h"rOJQJ^JhS(h[5OJQJ^J567vwxy}ԛ՛CEFGϜam^QQQhS(h~<OJQJ^Jh~h~<0JOJQJ^J'j'>h~h~<OJQJU^Jh;hh~<OJQJ^Jjh~<OJQJU^JhLh~<6OJQJ^JhQOJQJ^JhS(h%QVOJQJ^Jh~<OJQJ^JhS(h~<0JOJQJ^J!jhS(h~<OJQJU^J'j<hS(h~<OJQJU^JabcߝSTUӞGھھ~ھqcqRq!jhS(h'OJQJU^JhLh'6OJQJ^JhS(h'OJQJ^J'jyAhS(h~<OJQJU^JhLh~<6OJQJ^JhQOJQJ^JhR`OJQJ^Jh~<OJQJ^JhS(h~<OJQJ^JhS(h~<0JOJQJ^J!jhS(h~<OJQJU^J'j @hS(h~<OJQJU^JGHI NOPھnaMn>na4hOJQJ^JhS(h4i0JOJQJ^J'jDhS(h4iOJQJU^JhS(h4iOJQJ^J!jhS(h4iOJQJU^JhLh+l6OJQJ^JhS(h+lOJQJ^JhQOJQJ^JhS(hOJQJ^JhS(hR`OJQJ^JhS(h'OJQJ^JhS(h'0JOJQJ^J!jhS(h'OJQJU^J'jBhS(h'OJQJU^JšơТѢ#$ޤߤ( &`#$gdggd7gd~<gd@^ӠԠQRS¡ášơʡ֡&'߬ߐuhWhCW'jGhS(h7OJQJU^J!jhS(h7OJQJU^JhS(h7OJQJ^JhLhj6OJQJ^JhS(hjOJQJ^JhS(h4iOJQJ^JhS(h~<0JOJQJ^J'jEhS(h~<OJQJU^J!jhS(h~<OJQJU^JhLh~<6OJQJ^JhS(h~<OJQJ^JhQOJQJ^Jh~<OJQJ^J͢΢ТѢ֢ATUa£ã!"#$)uvɿxi_QDh~<h~<OJQJ^Jjh~<OJQJU^JhXmOJQJ^Jh~hp@0JOJQJ^J'jIh~hp@OJQJU^Jhp@hp@OJQJ^Jjhp@OJQJU^Jhp@hp@6OJQJ^Jhp@OJQJ^JhQOJQJ^Jh~<OJQJ^JhS(h7OJQJ^J!jhS(h7OJQJU^JhS(h70JOJQJ^JܤݤޤߤAstƥǥȥ ĺpaTG:hS(hjOJQJ^Jh;hh;hOJQJ^Jhp@h~<OJQJ^JhS(h~<0JOJQJ^J'jLhS(h~<OJQJU^J!jhS(h~<OJQJU^JhLh~<6OJQJ^JhS(h~<OJQJ^JhXmOJQJ^Jhp@OJQJ^Jh~<OJQJ^Jh8h~<0JOJQJ^Jjh~<OJQJU^J'jKh8h~<OJQJU^J &'(*+1245689:hS(hjOJQJ^Jh(0JmHnHuhZf hZf0JjhZf0JUhFdjhFdU()*6789:gd@^ &`#$gdg< 0 0&P1h:p D/ =!"#$% }DyK _Toc114641940}DyK _Toc114641941}DyK _Toc114641942}DyK _Toc114641943}DyK _Toc114641944}DyK _Toc114641945}DyK _Toc114641946}DyK _Toc114641947}DyK _Toc114641948}DyK _Toc114641949}DyK _Toc114641950}DyK _Toc114641951}DyK _Toc114641952}DyK _Toc114641953}DyK _Toc114641954}DyK _Toc114641955}DyK _Toc114641956}DyK _Toc114641957DyK http://www.sendmail.orgyK 2http://www.sendmail.org/!DyK +http://www.sleepycat.com/products/db.shtmlyK Vhttp://www.sleepycat.com/products/db.shtmliDyK =http://sourceforge.net/project/showfiles.php?group_id=112121yK zhttp://sourceforge.net/project/showfiles.php?group_id=112121$$If!vh5505x #v#v0#vx :Vl  t6,5505x py$$If!vh5505x #v#v0#vx :Vl t6,5505x y$$If!vh5505x #v#v0#vx :Vl t6,5505x y$$If!vh5505x #v#v0#vx :Vl t6,5505x y$$If!vh5505x #v#v0#vx :Vl t6,5505x y$$If!vh5505x #v#v0#vx :Vl t6,5505x $$If!vh5t5#vt#v:Vl  t65t5pc$$If!vh5t5#vt#v:Vl t6,5t5c$$If!vh5t5#vt#v:Vl t6,5t5c$$If!vh5t5#vt#v:Vl t6,5t5c$$If!vh5t5#vt#v:Vl t6,5t5c$$If!vh5t5#vt#v:Vl t6,5t5c$$If!vh5t5#vt#v:Vl t6,5t5c$$If!vh5t5#vt#v:Vl t6,5t5$$If!vh5t5#vt#v:Vl  t65t5p]$$If!vh5t5#vt#v:Vl t65t5]$$If!vh5t5#vt#v:Vl t65t5]$$If!vh5t5#vt#v:Vl t65t5]$$If!vh5t5#vt#v:Vl t65t5$$If!vh5;55h#v;#v#vh:V lJ 0,5;55h9pT$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$If!vh5;55555h#v;#v#vh:V l0,5;55h9p<T$$Ifl!vh5555#v:V l (0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T$$Ifl!vh5555#v:V l0,59alp(T\ Dd `5$0  # A" nSq=BVxդ# /@= nSq=BVxդ#B<4pepZz x\}l{w{3d@s['@>dLKŴ#4@PTI* ?& 4iL 4@Q={{kl\/'g޼fYKS ].8=gV'f͟ *V?@,ȖXeh1aBqJ Fa9/Excf2hL^aB)EOtYN%g'=:-dT*Ŕ8(47.t?#! &o[ a Կ_ įϠr $//i1?s#Z!^N\:ĩLuD/K+4泗a< N#.?:( r`,X1q]Vmѧl/ m]ڞ-_Y}[mOu&W_T&Әlg{͟gj[止>oT'4ofy2i3XbS Y|翊&gGXO8d}%3ߢk8C^#S@;0ia_ 3fy B/6IK"]~ty ;zſ+xxv Ig#ZS#>ݙ'ZěU3N?2D;'ZfhWd3NӜ8C9wu4w|*?d2aBV2VoLX_K>N5xKJo3'jE}>}NE>'⢏qqǸωcD\\Cܦk1o`6'Zěfh qE|jƉa3NqE'Yfh1D<3N8"NnMc4XRp,{h;lhQe6Y*1qwk1هNj1fqj<*=S;)8(čvh@oyH,8~{y6Le]YeՈYzլYǓwXt\nqEJ٬]}{l{a:}򣬏א-V6x ,kiuiF1Gu~Sȗ|1^cbӁ쟖i:CJ|fNJ{U^iz^I^Mwݛ01U5RF;a/OtC97TyP:>ET/t|o$宠J S*5A/#t|D["wEʟEN]Kq=?*{QG~o 09ӱ=(>CnLާ獞ԑ,U!+5#8{5Y^s<#c9MC2V+rssWS“:2n:7cX+'*"YROȟ5x.#_ǘWʰ,R>W^+c90cqz_?"7=b , iv@#2MAFrWb] y)M}X EP VC]8XS-6wFX=ĖdO㾅Rʵ59(RF8wNkKc[~i}/a"2G1)fɫ4'b\er"s J-䮠qc۶!˰Y.䒜rǛNLՐߦ.JFׂ|zmO.ߣ)vC9]>an'OD^.? } Ә2bO0ǔd]l17-2]b15cFڐ]&|c$@5ڎr]܃m*b1]mmvs;)ܧvs;9܇s[sr9֟kGyFbvȵH!c0|7 } '2#t _yHKdK: wExGJ:_}4ѣXy)cp˺39o|_(?EwK]$\@$+@j:aL?L#M7vRaxO 8?r _Q['}~~$lDdncR|ۯ$W^MD|ܜ2ٟ!yc94~x4sY :/b|+~N[= 9}D 2*M8CK05JQs-L?k|[I>H)9lbyWk;떲uϰ?ed2ccq:W9IgJ4xEs8oT>_8(c%߁LcŶX !.le5f=naȰkp^Zaq!+=/ ,X7>{:+.f^ydz)Y_ngf؍uk:{RT/.af_pl=BҾG)؂{=/f }7k`>_c-Dct3cTrnW` T4{;"60.0FT[~k7C'FeЌDyK )http://www.advogato.org/article/816.htmlyK Rhttp://www.advogato.org/article/816.htmluDyK @http://www.ietf.org/internet-drafts/draft-katz-submitter-01.txtyK http://www.ietf.org/internet-drafts/draft-katz-submitter-01.txtDyK chttp://www.ipswitch.com/support/ics/guides/IMailServer/8_2/IMailUGHTML/Chapter%202%20config12.htmlyK http://www.ipswitch.com/support/ics/guides/IMailServer/8_2/IMailUGHTML/Chapter 2 config12.htmlYDyK 9http://www.linuxhomenetworking.com/linux-hn/sendmail.htmyK rhttp://www.linuxhomenetworking.com/linux-hn/sendmail.htmDyK Chttp://www.ietf.org/internet-drafts/draft-lyon-senderid-pra-01.txtyK http://www.ietf.org/internet-drafts/draft-lyon-senderid-pra-01.txtDyK Dhttp://www.ietf.org/internet-drafts/draft-lyon-senderid-core-01.txtyK http://www.ietf.org/internet-drafts/draft-lyon-senderid-core-01.txtADyK 3http://www.maawg.org/about/whitepapers/spf_sendID/yK fhttp://www.maawg.org/about/whitepapers/spf_sendID/5DyK phttp://www.microsoft.com/downloads/details.aspx?familyid=8958AB23-F350-40FE-BA0A-2967B968FD8D%20&displaylang=enyK http://www.microsoft.com/downloads/details.aspx?familyid=8958AB23-F350-40FE-BA0A-2967B968FD8D%20&displaylang=enDyK Lhttp://www.microsoft.com/mscorp/safety/technologies/senderid/resources.mspxyK http://www.microsoft.com/mscorp/safety/technologies/senderid/resources.mspxDyK _http://download.microsoft.com/download/1/1/8/1184dafa-f1c6-4cd6-8fa1-0b06abbebd79/spf_tips.pdfyK http://download.microsoft.com/download/1/1/8/1184dafa-f1c6-4cd6-8fa1-0b06abbebd79/spf_tips.pdf%DyK ,http://sourceforge.net/projects/sid-milter/yK Xhttp://sourceforge.net/projects/sid-milter/DyK Ehttp://www.ieft.org/internet-drafts/draft-schlitt-spf-classic-02.txtyK http://www.ieft.org/internet-drafts/draft-schlitt-spf-classic-02.txt@@@ NormalCJ_HaJmH sH tH V@V t Heading 3$<@&5CJOJQJ\^JaJDA@D Default Paragraph FontRi@R  Table Normal4 l4a (k(No List6U@6 ! Hyperlink >*B*ph4 @4 ?HFooter  !.)@. ?H Page NumberB^@"B 4 Normal (Web)dd[$\$e@2 <HTML Preformatted7 2( Px 4 #\'*.25@9CJOJQJ^JaJj@Cj ?m Table Grid7:V04@R4 ""Header  !.@. tTOC 1OJQJD@D FGTOC 2 $ dh^OJQJ6@6 tTOC 3 ^OJQJFV@F %:wFollowedHyperlink >*B* ph: GHIJKLMNOaj}~    !lmLWM#$] @L  *+45"#RS?@~F > p !K!m!x!|"###%n%%%%%&+&>&&&&*'S'm'''!(K((((()G)V) *Y**+X+++,o,,,,, -$-2-E-e-~------.!.D.E......000001e1111112r22222 3L3333334444444455%6F6S6c6666777878B8U8V8W8z8{888*9?999C:l::::+;7;d;;<-<F<<<<<<>>????X@w@@@@@@@@ B B3B8BDBMBNBVBqBBBBCCC'CCCCDD DrDDDDE EEEEE(E2E>E?ECEEEEEEFF F1FSFTFWFFFFFFGGGGGGGxHHHHHHHHHHI1I2I4IXIlImIoIIIIJJJJJ(J)JLJK*KKKiLLwMMNNPO\OOOOOOOPP%S&S'SCSDSUUUUV+V,V.V2V6V:V>V@VAVhVoVvV}VVVVVVVVVVVVVW WWWW?WFWMWTW[W`WaWyWWWWWWWWWWWWWWWX XXXXXBXIXPXWX^XcXdXXXXXXXXXXXXXXX$Y+Y2Y9Y@YHYIYqYxYYYYYYYYYYYYYZZ!Z(Z/Z7Z8Z9ZBZZZ}[[[[[[^^``3b4bc c!c2cJcccmcncpcscxczc{c}cccccccccccccccccccccccccccccccccccccddd dddddd!d'd*d+d,d.d/d0dOdPd[f\fff@iAisitiElFlnnooppsssspvqvvvyyyy||||}}}}}~~.0nopqHInopqMNxyřƙКњ#$ޜߜ()*678;000000000000000000000000000000000000000000000000000000000000000000000000000000000000 0 0 0 000000000 00 00 00 00 00 00000000000000000 0 0 0 0 0 0 0 0 0>  0>  0>  0 0  0 0! 0! 0! 0x! 0! 0 0# 0#% 0#% 0#% 0#% 0# 0% 0% 0% 0# 0& 0# 0& 0& 0& 0& 0' 0' 0# 0K( 0( 0( 0( 0( 0K( 0G) 0G) 0K( 0Y* 0* 0Y* 0X+ 0Y* 0+ 0Y* 0o, 0o, 0o, 0  0, 0, 0, 0  0E- 0  0~- 0~- 0- 0~- 0- 0- 0-000000.0.0. 0. 0. 0. 0. 0. 0e1. 01. 01. 01. 01. 0. 02. 0r2. 0r2. 02. 02.0.0. 02. 0r2. 03. 03. 03. 03. 03. 02.0.0.004 04 04 04 054 054 0F64 0F64 0F64 04 064 064 064 064 074 074 074040400W8 0W8 0{8W8 0W8 08W8 08W8 08W8 08W8 09W8 09W8 09W8 09W8 09W8 08W8 0+;W8 0+;W8 08W8 08W8 0<W8 08W80W80W800<0<0<0<0< 0< 0< 0< 0?< 0< 0w@<0<0<0<000@0@0@0@ 0@ 0@ 0@ 0@ 0@ 0@ 0@ 0@ 0@ 0@ 0@ 0@ 0@ 0@0@0@ 0@ 0@ 0@ 0@ 0@ 0@ 0@ 0@0@ 0@ 0@0@0@0@ 0@ 0@ 0@ 0@0@ 0@ 0@ 0@0@ 0@ 0@ 0@0@ 0@ 0@ 0@0@ 0@ 0@ 0@0@ 0@ 0@ 0@0@ 0@ 0@ 0@0@ 0@ 0@0@0@0@ 0@ 0@ 0@ 0@0@ 0@ 0@ 0@0@ 0@ 0@ 0@ 0@ 0@ 0@0@ 0@ 0@0@0@0J 0J 0)JJ 0J 0KJ 0J 0KJ 0J 0iLJ 0J 0wMJ 0J 0NJ 0J 0POJ0J0J0J00O0O0O0O0O0O0O0'S0'S0'S0'S0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S 0'S0'S 0'S 0'S 0'S 0'S01S01S0O0[0[0[0[0[0[0[0[0[0[0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[ 0[0[0[0[0O0O0Yd0Yd0Yd0Yd0Yd0Yd0Yd0Yd0Yd0Yd0Yd0Yd(0Yd0n0n0n0n0n0n0n0n0n0n0n0n0n0n0n0n0n0n0n0n0n0n0n0n0O(0 ~0"~0"~0"~0"~0"~0"~00{0{0{0{0{0{0{0{0{0{0{0{0{0{0{0000000000000000000000000000000@00h00@00h00@00h00@00h00@01@0@0@0@0@0h00 GHIJMNOa  ! @L  *+45"#RS?@~F > p !K!m!x!|"###%n%%%%%&+&>&&&&*'S'm'''!(K((((()G)V) *Y**+X+++,o,,,,, -$-2-E-e-~------.!.D.E......000001e1111112r22222 3L3333334444444455%6F6S6c6666777878B8U8V8W8z8{888*9?999C:l::::+;7;d;;<-<F<<<<<<>>???X@w@@@BBCC'CCCCDD DrDDDDE EEEE(E2E>E?ECEEEEEFF F1FSFTFWFFFFFFGGGGGGHHHHHHH1I2I4IlImIoIIIIJJK*KKKwMOOUV+V,V.V2V6V:V>V@VAVhVoVvV}VVVVVVVVVVVVVW WWWW?WFWMWTW[W`WaWyWWWWWWWWWWWWWWWX XXXXXBXIXPXWX^XcXdXXXXXXXXXXXXXX$Y2Y9Y@YHYIYqYYYYYYYYYYYYZ7Z8Z[2cJcccmcncpcscxczc{c}cccccccccccccccccccccccccccccccccccccddd dddddd!d'd*d+d,d.dPd[f\fff@iAisitiElFlooppsssspvqvvvyyy||||}IMyřƙКњ#$;000000000000000{00 X {00 {000{00{00{00{000{00 T @0@0@0000000 00000000 0 0 0 00000000 00 00 00 00 00 000 0000000000000 0 0 0 0 0 0 0 0 0O 0O 0O 0 0 0 0, 0, 0, 0 0, 0 0|! 0# 0# 0# 0# 0|! 0# 0# 0# 0|! 0$ 0|! 0$ 0$ 0$ 0$ 0% 0% 0|! 0D& 0& 0& 0& 0& 0D& 0@' 0@' 0D& 0R( 0( 0R( 0L) 0R( 0) 0R( 0c* 0c* 0c* 0  0* 0* 0* 0  09+ 0  0r+ 0r+ 0+ 0r+ 0+ 0+ 0+000000,0,0, 0, 0, 0, 0, 0, 0., 0/, 0/, 0/, 0/, 0, 0/, 0/, 0/, 0E0, 0E0,0,0, 0E0, 0/, 0$1, 0Z1, 0Z1, 0Z1, 0$1, 0/,0,0,00m2 0m2 0m2 0m2 0K3m2 0K3m2 03m2 03m2 03m2 0m2 04m2 0=4m2 0=4m2 04m2 0z5m2 0z5m2 0z5m20m20m2005 05 065 05 0V65 0V65 0V65 0V65 0v75 0v75 0v75 0v75 0v75 0V65 085 085 0V65 0V65 095 0V65{00:0500g:0g:0g:0g: 0g: 0g: 0g: 0U=g: 0g: 0=g:{0x0y1K00I{0x0K00I {0|0}L2{0|0{0z0{0z0{0x0K00I {0z0{0z0{0y0X K00I{0{0Z|{0{0Y {0{0X{0y0V K00JK00J{00Zx{00Y {00W K00J{00W {00W K00J{00W {00Y{00W K00J{00W {00Y{00W K00J{00W {00Y{00W K00J{00W {00Y{00W K00J{00W {00W K00J{00Y {00VlK00IK00I{00W {00W K00J{00W {00W K00J{00Y {00WK00J{00Y {00WK00J{00Z {00WdK00J{00X{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{0 0{0 0{0 0{0 0{0 0{0 0{00{0 0{0 0{0 0{0 0{0 0{0 0{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00{00 {00 {00 {00{00Y{00WK00I{00U{00U{00UK00I{00U{01YdA{01X{01W{00UK00I{0 1U{0 1Y  B{0 1X{0 1W{0 1UK00I{01U{01YB{01X{01W{01UK00I{01U{01Y\C{01X{01W{01UK00I{01U{01UCK00IK00K00<K00<K00<K00<K00K00<K00<K00<K00<K00K00<K00<K00<K00<K00K00<K00<K00<K00<K00K00<K00<K00<K00<K00K0 0<K0 0<K0 0<K0 0<K00K0 0<K0 0<K0 0<K0 0<K00K00<K00<K00<K00<K00K00<K00<K00<K00<K00K00<K00<K00<K00<K00K00<K00<K00<K00<K00K00 K00 K00 K00 K00K00K00{0c1dt.{0c1{0c1{0d1@0{0h1{0h1@0@0@0@0{0n1@0@0@0{0r1{0s1 @0{0r1{0r1{0r1@0@0@0{0{1@0@0{01#{01"{01!@0@0{0d1eK{0d1{0d1K00{0C{0{0k0@0@0@0@0@0@0@0{0t0{0u10K00{0k0{0k0{0k0K00K00 %%%(}k M ]&("-068r:<[?FDHK NP)TW'[,^abe.lpvyZ5aG:TXZ[\]^`abdeghjlnoqstwy| &+0 509;?BHMJJKLLM>MMNSNNOOPP1QlQQRS'[+^>^@^A^^^^^__`_a_____``c`d`````HaIaaaaa7b8bmkskkkkkkkkll*l0l(:UWY_cfikmpruvxz{}~9V!3Lhj,HJs7SUe -IKp!=Y[x90s005k55!J6vԓFbTH OӘR™&͚T›!uܜsǝ : %%%%%%%%%%%%%%%%%%XXXXXXXXXXXXXXX !(!!8@0(  B S  ? _Toc114641940 _Toc114641941 _Toc114641942 _Toc114641943 _Toc114641944 _Toc114641945 _Toc114641946 _Toc114641947 _Toc11464194829059291242912629120291222911629118 _Toc114641949 _Toc114641950 _Toc114641951 _Toc114641952 _Toc114641953 _Toc114641954 _Toc114641955 _Toc114641956 _Toc114641957.4W8<@JJJJJJJJO'S[0dn}q;  !.4y8<@JJJJJJJ'JOBS[Ndn~; ; J< "= "> tH? H@ 4"A t"B "C "D "E "F |"G |" ..;     ..; 8*urn:schemas-microsoft-com:office:smarttagsCity= *urn:schemas-microsoft-com:office:smarttags PlaceType= *urn:schemas-microsoft-com:office:smarttags PlaceName9 *urn:schemas-microsoft-com:office:smarttagsplace 8z6   ,3u{9>@BDF,7[au|4 7 r t v !!M!O!Q!l!o!q!""A#J#$$$x$~$$$p%r%t%%%%%%%%%%%%%%&&&*&-&/&'"'9'?'^'l''''''''''(( (#(%(&(>(?(J(b(m((((((((()) )6):)=)V)Z)))**++ +#+]+f+h+{+++++++++,,,,,,,,,,,,,,,,---#-&-(-4-6-o-w-l/|/P1U111112222223"3W3b333334444 555566'6)6+6E6H6M6N6R6j6u6{66666666777777888 8"86898;8D8F888888879>9::9;<;7<?<<<g>o> ??0?8???????@@@@@@CC`EcEEEEEFFTFVFFFFFGGxHHI&IXIaIoIwIIIJ J0J2J"M,MMMQQMRSRHVJVVVVV&W(WhWjWkWuWWWWWWW&X(X2[4[\\u^|^i_x_ddddffffffggAgOgjiqiiiiiiijjjjjj4k@kCkFkMkYkkkmknkvkkkkkkk$l'lmmmmFqNqPqRqqqrrssssss7t@tgtutuuvvvvvvwwwwwwwwwwxxxxxxxxyyyyyyyy6z?zfztz}}}}$,25NVNVFN&RX)4JP8;V)Z)G*J*00 33L3V333p:v:::::;;g>o>0?8?ADGDQGSGGGQQRR\\^^gghhttzz}}8;3333333333333333333333333333Lk,Ks7Ve-Lp"=\xT"uݜ'*5;8;%xڲ&{ߨ"/or4|Jf@$uta*`Pe1ޛ#5X-1:<ߨ"9T$=i`ID1IsLoQxjbDb]brk8>=k1zU{r^`o() ^`hH. pLp^p`LhH. @ @ ^@ `hH. ^`hH. L^`LhH. ^`hH. ^`hH. PLP^P`LhH.^`o() ^`hH. pLp^p`LhH.h @ @ ^@ `o(hH. ^`hH. L^`LhH. ^`hH. ^`hH. PLP^P`LhH.h ^`hH.h ^`hH.h pLp^p`LhH.h @ @ ^@ `hH.h ^`hH.h L^`LhH.h ^`hH.h ^`hH.h PLP^P`LhH.h^`OJQJo(hHh^`OJQJ^Jo(hHohpp^p`OJQJo(hHh@ @ ^@ `OJQJo(hHh^`OJQJ^Jo(hHoh^`OJQJo(hHh^`OJQJo(hHh^`OJQJ^Jo(hHohPP^P`OJQJo(hHh ^`hH)h ^`hH.h pLp^p`LhH.h @ @ ^@ `hH.h ^`hH.h L^`LhH.h ^`hH.h ^`hH.h PLP^P`LhH.h ^`hH)h ^`hH.h pLp^p`LhH.h @ @ ^@ `hH.h ^`hH.h L^`LhH.h ^`hH.h ^`hH.h PLP^P`LhH.808^8`0o(. ^`hH. pLp^p`LhH. @ @ ^@ `hH. ^`hH. L^`LhH. ^`hH. ^`hH. PLP^P`LhH.h ^`hH)h ^`hH.h pLp^p`LhH.h @ @ ^@ `hH.h ^`hH.h L^`LhH.h ^`hH.h ^`hH.h PLP^P`LhH.^`o() ^`hH. pLp^p`LhH.h @ @ ^@ `o(hH. ^`hH. L^`LhH. ^`hH. ^`hH. PLP^P`LhH.h ^`hH)h ^`hH.h pLp^p`LhH.h @ @ ^@ `hH.h ^`hH.h L^`LhH.h ^`hH.h ^`hH.h PLP^P`LhH.h ^`hH.h ^`hH.h pLp^p`LhH.h @ @ ^@ `hH.h ^`hH.h L^`LhH.h ^`hH.h ^`hH.h PLP^P`LhH.h ^`hH.h ^`hH.h pLp^p`LhH.h @ @ ^@ `hH.h ^`hH.h L^`LhH.h ^`hH.h ^`hH.h PLP^P`LhH.h HH^H`hH.h ^`hH.h L^`LhH.h   ^ `hH.h ^`hH.h XLX^X`LhH.h ((^(`hH.h ^`hH.h L^`LhH.808^8`0o(. ^`hH. pLp^p`LhH. @ @ ^@ `hH. ^`hH. L^`LhH. ^`hH. ^`hH. PLP^P`LhH.h   ^ `hH)h ^`hH.h  L ^ `LhH.h { { ^{ `hH.h KK^K`hH.h L^`LhH.h ^`hH.h ^`hH.h L^`LhH.h ^`hH.h ^`hH.h pLp^p`LhH.h @ @ ^@ `hH.h ^`hH.h L^`LhH.h ^`hH.h ^`hH.h PLP^P`LhH.h ^`hH.h ^`hH.h pLp^p`LhH.h @ @ ^@ `hH.h ^`hH.h L^`LhH.h ^`hH.h ^`hH.h PLP^P`LhH.1:<&{#5ta*LoQ=k`IDf@$be1Db]%I4|zU{/o9T$=                                    Pܪ[                                                                                        +*zTfPS[QEY cTddM*dn2_add;ZBPSyB.b#JPScTjeV_a0~z/.wR&J">)N/P.GP9@28g\zW1Ba)qen] }  ( x2 V 'w ' I l HUt45l@*}P(Z,hCFx+@OV[2Qp>yQl=?D(]Q_eyA"p@~v aj>gp%(/Mr` b#!,!"""6#$F$gL$Cz%I&K&''Y7'S?(<<)=)u)$*i+$'+5c,lr,E-&.K.ue.1/#0la0*1R1d2z2*3%3w3$$4+414U[43545+6v?6V788~M8z8s:9L90:I: ;<,</6<<<_<l =[&=d=Rm=u->^>j>l>w>\? A#ACXA,?BMB CCDCuCTwCE1EAE SE;?FvFH?HpH]IiJXoKULM!M4MFMFMRMjYM(NekNjOa'O}O PnP@Q\QzQ-R[Rp^S8T_TUV%QVTVVvLWXA8X'dXCjXCYpYpYvYa|Y1Z [[do[es[Y]]]N^`O`R`u`1a}IaNa6kc#qc$de/efe0;f7SfZf/h hfh8+i4iupiCj0PjRjrk+lTl_ltl)m?mXmXo^pLpnuprq~r"r@rG3sYss^sW}s06t,Tt2itst^ytau w%:w^wawRy%z@z'Hz|_|{|}|(}E}#3-T1\o&oorK_fFBL'f2 #?|6NF3Zp7:BP!AWINB(1r9'4Cn[gw?%h)o+O0yY!si1qSiozv<qyr>nZnR -G~$.V r4R|f;hB46 DL)Y.V^yaW\Xs;,0vXipvwt^ `lsHMc\Tv $d+8~@=08n?FGdA!@@0+..;T~G>EIup~<im@^:4g\t{}75AS_897hmn}e.;j\m/{zA@j:I}l%K`!NIiJ[rK+rk6rv!Iv(P8m_64Q.B`c|<*x444(6d#r@TNyc6M:*.k"""$[aeVo%I 4I!QFdI=0`h@nQjI+0Aa>h9iF -:U.5~bt* P0S(kk|ZsNbE5Jkb\f3B8BDBMBNBVBqBBBBCCC'CCDD DrDDDDEEE(E2E>E?ECEEEEFF FSFTFWFFFFGGGGGGHHHHHHH1I2I4IlImIoIIIIJJUUV+V,V.V2V6V:V>V@VAVhVoVvV}VVVVVVVVVVVVVW WWWW?WFWMWTW[W`WaWyWWWWWWWWWWWWWWWX XXXXXBXIXPXWX^XcXdXXXXXXXXXXXXXXX$Y+Y2Y9Y@YHYIYqYxYYYYYYYYYYYYYZZ!Z(Z/Z7Z8Z!c2cJcccmcncpcscxczc{c}cccccccccccccccccccccccccccccccccccccddd dddddd!d'd*d+d;@%%r*%%:P@UnknownGz Times New Roman5Symbol3& z Arial7&  Verdana?5 z Courier New;Wingdings"1hCfCflFB,B,$4dћћ 2QX ??D6Adventures in Milter-land& P            Oh+'0   @ L X dpxAdventures in Milter-land Normal.dot2Microsoft Office Word@F#@6@Zp@Zp՜.+,D՜.+,\ px  ,Bћ Adventures in Milter-land Title  8@ _PID_HLINKSA ZCcEhttp://www.ieft.org/internet-drafts/draft-schlitt-spf-classic-02.txt1 f/`,http://sourceforge.net/projects/sid-milter/1 0]_http://download.microsoft.com/download/1/1/8/1184dafa-f1c6-4cd6-8fa1-0b06abbebd79/spf_tips.pdf1 {'ZLhttp://www.microsoft.com/mscorp/safety/technologies/senderid/resources.mspx1 3vWphttp://www.microsoft.com/downloads/details.aspx?familyid=8958AB23-F350-40FE-BA0A-2967B968FD8D%20&displaylang=en1 pT3http://www.maawg.org/about/whitepapers/spf_sendID/1 *tQDhttp://www.ietf.org/internet-drafts/draft-lyon-senderid-core-01.txt1 $vNChttp://www.ietf.org/internet-drafts/draft-lyon-senderid-pra-01.txt1 KK9http://www.linuxhomenetworking.com/linux-hn/sendmail.htm1 CbH_http://www.ipswitch.com/support/ics/guides/IMailServer/8_2/IMailUGHTML/Chapter 2 config12.html1 90E@http://www.ietf.org/internet-drafts/draft-katz-submitter-01.txt1 EB)http://www.advogato.org/article/816.html1 .S?=http://sourceforge.net/project/showfiles.php?group_id=1121211 fl<+http://www.sleepycat.com/products/db.shtml1 TA9http://www.sendmail.org/1   !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~Root Entry FppData 9N1TableWordDocument>SummaryInformation(DocumentSummaryInformation8CompObjq  FMicrosoft Office Word Document MSWordDocWord.Document.89qRoot Entry F tData 9N1TableWordDocument>՜.+,D՜.+,\ px  ,Bћ Adventures in Milter-land Title  8@ _PID_HLINKSA ZCcEhttp://www.ieft.org/internet-drafts/draft-schlitt-spf-classic-02.txt1 f/`,http://sourceforge.net/projects/sid-milter/1 0]_http://download.microsoft.com/download/1/1/8/1184dafa-f1c6-4cd6-8fa1-0b06abbebd79/spf_tips.pdf1 {'ZLhttp://www.microsoft.com/mscorp/safety/technologies/senderid/resources.mspx1 3vWphttp://www.microsoft.com/downloads/details.aspx?familyid=8958AB23-F350-40FE-BA0A-2967B968FD8D%20&displaylang=en1 pT3http://www.maawg.org/about/whitepapers/spf_sendID/1 *tQDhttp://www.ietf.org/internet-drafts/draft-lyon-senderid-core-01.txt1 $vNChttp://www.ietf.org/internet-drafts/draft-lyon-senderid-pra-01.txt1 KK9http://www.linuxhomenetworking.com/linux-hn/sendmail.htm1 CbH_http://www.ipswitch.com/support/ics/guides/IMailServer/8_2/IMailUGHTML/Chapter 2 config12.html1 90E@http://www.ietf.org/internet-drafts/draft-katz-submitter-01.txt1 EB)http://www.advogato.org/article/816.html1 .S?=http://sourceforge.net/project/showfiles.php?group_id=1121211 fl<+http://www.sleepycat.com/products/db.shtml1 TA9http://www.sendmail.org/1 SummaryInformation(DocumentSummaryInformation8CompObjq