验证传入的电子邮件发件人

Question

I want to develop a system with which users interact by sending in email. Very much like most email discussion groups or like posterous.

What checks should I apply to incoming email to make sure it comes from the address it claims to be?

Answer 1

There is no method of authenticating email in a reliable, universally available and easy to use fashion.

The best way of handling this is probably by giving your users a unique, hard to guess email address to send their emails to (something like 459f71b01809458adfe17a7d838dcb19@postbymail.yourdomain.com ). You authenticate them based on the assumption that they're the only ones who know that address. When you do this, you also need to add a way for users to invalidate the address and generate a new one (in case it was compromised). And don't forget to make it easy for them to get the address in places where they can't easily copy & paste it, like on a mobile phone (easiest done by adding a button that sends them an email with the generated address as sender).