“发送给朋友” - 风险
假设我有一个网站，允许用户将该网站上的文章发送给朋友。
它的工作原理是，当单击“发送给朋友”链接时，会出现一个表单，用户可以填写详细信息，然后会将电子邮件发送给他们的朋友。
用户可以在此表单中输入“发件人”电子邮件地址和“收件人”电子邮件地址以及少量内容。
收到电子邮件后，发件人电子邮件地址将显示在“发件人”和“回复”中。
该网站还向其用户发送大量自己的电子邮件通信。
我的问题是：
允许用户（机器人、攻击等）使用此应用程序从我的 SMTP 发送电子邮件是否存在风险？风险有多大？
我的假设是是的，但这并不理想。
这可能比“不理想”更糟糕吗？
Let say I have a website that allows users to send articles on that website to a friend.
The way it works is that when the "send to a friend" link is clicked a form appears and it allows users to fill in the details and an email is sent to their friend.
The user can put in a "from" email address and a "to" email address into this form and a small amount of content.
When the email is received the from email address appears in the FROM and REPLY TO.
This website also sends a great deal of its own email communications to its users.
My question is:
Is there risk to allowing users (bots, attacks etc) to use this application to send emails from my SMTP, and how great is the risk?
My assumption is yes, this is not ideal.
Is it possibly worse than "not ideal"?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我不知道机器人会使用您的表单。这应该是一个问题吗？我不知道......我确实知道他们将机器人编程得非常聪明，使用您的自定义表单等等。
我确实知道一些电子邮件服务器会检查发件人电子邮件地址的 IP 地址是否与发送邮件的 IP 地址相同。想象一下，我输入了我的 hotmail 电子邮件地址，邮件服务器看到您的服务器，它可能会将电子邮件标记为垃圾邮件。
过去我有一个电子贺卡网络系统。这是我和一个认识的女孩合资的小型企业。她创建了（可爱的）卡片，我为她构建了一个电子卡片系统。该网站非常简单。选择卡片，输入电子邮件地址，将发件人电子邮件地址放在“发件人”中，然后发送电子邮件，您将收到电子贺卡。
生活本来是美好的...
直到我发现我的整个网络服务器 IP 被三大垃圾邮件过滤机制列入黑名单。在过去从我的网站接收电子贺卡的所有电子邮件收件人中，有 15% 不会收到电子贺卡，因为我的所有电子邮件从一开始就被列为垃圾邮件黑名单。我们收到了许多来自愤怒的“客户”的电子邮件，要求他们的电子贺卡没有到达。 （我仍然觉得有些人要求这项服务很有趣，特别是因为它是免费服务，想想吧）。我的自动提醒功能告诉他们电子贺卡仍然没有被查看，他们可能输错了电子邮件地址，所以这可能会让他们生气:P
这对我的其他客户来说也很烦人，因为他们依赖于发送播放简讯等，并打电话给我说超过 20% 的客户没有收到简讯。
发送电子邮件很难。您还应该查看 Jeff 的博客 关于此内容。因此，请从我的错误中吸取教训，并将与您的电子邮件服务器关联的电子邮件地址放入 FROM 中。这会让你省去很多麻烦;)
I do not know about bots using your form. Should it be a problem? I don't know.. I do know they program bots to be pretty clever, using your custom forms and all.
I do know that some email servers check if the FROM email address has the same IP address as the IP the mail was sent from. So imagine I put in my hotmail email address, and the mail server sees your server, it might flag the email as spam.
In the past I've an e-card websystem. It was a small joint venture with a girl I knew. She created the (cute) cards and I build her an e-card system. The website was pretty simple. Select card, enter email address, placing senders email address in the FROM and sent the email that you would have received an e-card.
Life was good...
Until I found that my entire web server IP was blacklisted at three major spam filtering mechanisms. And that 15% of all email recipients who used to receive e-cards from my site, would not receive their e-cards, because all my emails were blacklisted as spam from the get go. We have receive many many emails from angry "customers" demanding that their e-cards did not arrive. (I still find it funny how some people demanded the service, especially since it was a free service, go figure). My automatic reminder function was telling them the e-card still were not viewed, and they perhaps mistyped the email address, so that might have ticked them off :P
It was pretty annoying for my other customers as well, since they relied on sending out played newsletters and such and calling me that over 20% of the customers did not receive the newsletters.
Sending e-mails is hard. You should also check out Jeff's blog about this. So, learn from my mistake, and please put an email address associated with your email server in the FROM. This will spare you a lot of headaches ;)
是的，如果这是任何机器人都可以访问的公共网站，这绝对不理想。但您可以通过一些简单的方法来限制垃圾邮件的使用。
每天发送约 50 封电子邮件的地址
根据您的情况，每小时仅〜10
需要。机器人可能会尝试
一次发送一百万，所以限制他们
每小时和每天。
数据库并提出一个好的
监控最活跃的程序
电子邮件发件人。如果你可以验证
电子邮件是可信的，然后让
他们发送尽可能多的电子邮件
想要
考虑一下这个网站本身，它有非常明确的操作和声誉准则，这些准则会限制您，直到您证明自己是值得信任的。
yes this is definitely not ideal if this is a public website that any bot can access. but there are easy ways for you to limit spam use.
address to send ~50 emails a day and
only ~10 an hour based on your
needs. a bot would probably try to
send a million at once so limit them
on an hourly and daily basis.
database and come up with a good
program to monitor the most active
email senders. if you can verify
that an email is trusted, then let
them send as many emails as they
want
think about this site itself, it has very defined actions and reputation guidelines that limit you until you have proved you are trusted.
这可能取决于您是否进行任何身份验证来确定谁可以发送电子邮件。如果用户必须登录才能发送文章，那么您可能没问题。机器人会失败，因为它们永远不会登录。
您网站的流量越大，风险就会增加，是的，这可能不太理想。如果不受保护，机器人将不可避免地找到您不受保护的表单，并开始从您的服务器发送电子邮件。
不过，有一些非常简单的解决方案，最常见的可能是实现类似 Captcha 的解决方案
It may depend on whether you do any authentication to determine who's allowed to send emails. If the user has to be logged in to send articles, then you're probably fine. Bots will fail because they'll never be logged in.
The risk will increase the greater traffic you get to your site, and yes it's probably less than ideal. Unprotected, a bot will inevitably find your unprotected form, and start sending emails from your server.
There are some pretty easy solutions though, the most common probably being to implement something like Captcha
相当安全。我假设您确实检查了“发件人”地址，只要先向其发送一封（标准！）邮件并询问该电子邮件地址的所有者确认他们确实是人类？这可以防止大多数机器人找到并滥用您的表单。当然，人工回复您的验证电子邮件的定向攻击仍然会允许发送垃圾邮件。但是，如果您至少收到一封来自所谓的“发件人”地址的回复，那么您就会得到更好的线索。
但是，我认为这不会可靠地工作。引入 SPF 等技术意味着来自“example.com”的邮件只有来自 *.example.com 域中的传出 SMTP 服务器时才会被接受。如果您使用“发件人：地址@example.com”伪造电子邮件，接收 SMTP 服务器将发现您实际上不是 *.example.com 的一部分，并拒绝该电子邮件 - 并且可能会将您的 IP 范围列入黑名单。
Fairly safe. I assume you do check the "From" address, if only by sending it one (standard!) mail first and asking the owner of that email address to confirm they are really humans ? This prevents most bots from finding and abusing your form. Of course, a directed attack with a human responding to your verification email will still allow spamming. But you've got a much better trail if you have received at least one reply from the alleged "From" address.
However, I don't think this will work reliably. The introduction of techniques like SPF will mean that mails from "example.com" will only be accepted if they originate from an outgoing SMTP server in the *.example.com domain. If you're faking emails with From: addresses @example.com, the receiving SMTP server will see that you are in fact not part of *.example.com and reject the email - and probably blacklist your IP range for good measure.