I want to encode a small service where I can send an email to a specific address used by my server to send specific commands to my server.
I will check the list of allowed email addresses to make sure that none of the unauthorized ones sends the command to the server, but how can I make sure that, say, the email sent by "mrzombie @ thezombie.net" really comes from "thezombie.net"?
I thought about checking the header of the source IP email server and checking the domain to make sure it is the same, but will it be reliable?
Example:
The server receives a command from mrzombie@thezombie.net
mrzombie@thezombie.net is allowed, proceed to check The server checks the IP address of thezombie.net from the header: WXYZ Server pings "thezombie.net" for it IP: ABCD IP addresses do not match, do not process the team
Is there a better way to do this?
source
share