Sender email address verification

Question

During my recent DNS server outage (caused by XO DSL suddenly turning on filtering of port 53), I noticed something quite interesting with .Mac server and I am wondering if there is a way for Tiger server users to EASILY implement the same feature to reduce the inflow of spam?
When my DNS stopped, my .Mac account STOPPED accepting email from my work account, essentially saying there was no such account on my work server.
I obviously do understand that the fact that my DNS was not working and my server could not be verified was the reason for this, but it got me thinking....
Is there any easy way to put this sort of incoming email verification process on my OWN Tiger server (work)? i.e. Only accept delivery of incoming email AFTER you verify that the sender email address DOES correspond to a valid email account on the senders host?? - which means no bogus email address or hostnames accepted...
I think this would help cut down on a lot of Spam as these guys often send junkmail via bogus accounts/host names that cannot be replied to.
Any useful information regarding setting this up would be most appreciated
Thanks in advance - Rohin

Answer 1

My question is ... wouldn't it make sense to check whether sender emails are valid before accepting email server connections.
There's not really any way of doing that, besides, that's not really what you want.
What you want is to ensure that the email comes from the person that it says it comes from. What you'd get is that the email says it comes from a valid email address. This is not the same thing.
Even now, 99% of spam emails are sent from valid email addresses - it's trivial to put any email address in the 'from' header.
Knowing that the From address is valid doesn't actually do anything to say that the person in the From header is the one who actually sent the message in the first place.
There are several industry-wide attempts and performing validation at the domain level, which is about as good as it's going to get in the near term. For more information check out Sender Policy Framework which defines (via DNS) which IP addresses are permitted to send email for a particular domain, and DomainKeys which uses digital signatures to validate the email.
Since both models require input from the domain owners, they won't be 100% reliable until all domains opt-in to the schemes. For now it can help validate that an email is from a legitimate domain, but the absence of a SPF or DomainKey doesn't necessarily mean the message is spam.
The only way to verify that the email comes from a valid user is some kind of confirmation - an email comes into your mail system which doesn't recognize the sender, so it holds the mail and sends a message back to the sender saying 'who are you?" and "if this message is legitimate, follow this link to unblock the message". The message is forwarded only after the sender confirms their identity and that the message is legitimate.
This has all kinds of issues, though including latency (it takes longer for messages to get to you), delays (what if the sender sends the message right before they leave on a week's vacation?), and not least the complete lack of support for any kind of automated messages, list, etc. that are sent from non-humans.