updated 25th June @ 00:17 EDT
Here are the slides from my Best Mailing Practices talk.
While I was googling around to find the abstract I submitted with this, I discovered that there's an audio recording of me giving the talk at ZendCon 2007.
| View
Just in case slideshare vanishes, the PDF version is also available: Best Mailing Practices
Usually, a bounce contains a copy of the mail that yould not be delivered. We use this behaviour and add a new header with the value md5(SECRET . $recipient_address) to outgoing mails. This enables us to verify that bounces are not faked and act on them automatically (displaying a message to the user that something is wrong with his mail account, stop sending emails to him, ...).
Since you can't guarantee anything about the out-of-band bounce that you get back, I'd recommend using VERP and signing that address (you can use your salted md5 approach for that).
SRS does something like this already (check out libsrs2)
http://netevil.org/ in
Comment.
A "Best Practices for Sending Mail from PHP" ZendCon 2007 mp3 file (67M) can be downloaded from