Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently google chatback has been turned off, and I was searching for an alternative that allows visitors of my website to isntantly message me, without the need of having a login at facebook or something similar.

Furthermore I want to convinientley interact with them on my Phone, so Jabber appeard to be the way to go.

The idea is to set up my own jabber server and if a user sends a message, create an account on the fly, and use that

I have been programming peer 2 peer applications myself and can probably imagine how a jabber server enters the network (looking up common initial meeting points for other servers, scanning ips, getting information from other servers...).

Then later on my server would make known that it can handle messages for all accounts @mydomain.com

But how exactly is the legitimacy verified? All jabber servers just need to have it configured in their config.

I would have imagined a text record in the DNS settings of the domain with a fingerprint of some sort of public key of the server which the emitter of the other jabber server can use to request the reciever to verify its legitimacy before forwarding the message.

However no such thing appears to be the case.

Another way I could think of is just comparing the servers IP address with the one behind the DNS record of the domain.

However this would require the jabber server to be run on the same IP and would make situations with other kinds of records, for example Round-Robin-Ips (like google have) prett complicated. Also it would be vulnerable to a whole series of network level attacks and spoofs.

So whats the deal?

After this (I apologize for that) lengthy introduction, let me sum up my question as:

If a jabber server (A) sends a message from a user to another account on server B, how can A be sure that B really is the right server and not someone spoofing it?

share|improve this question

1 Answer 1

It appears that it is realy the case that the A record of a site is looked up, and the message is sent there.

So on this end it really does not even require any sort of p2p technology.

Additionally SRV records can be used to define different xmpp/jabber servers for that domain.

Its pretty well described here: http://prosody.im/doc/dns

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.