Recently google chatback has been turned off, and I was searching for an alternative that allows visitors of my website to isntantly message me, without the need of having a login at facebook or something similar.
Furthermore I want to convinientley interact with them on my Phone, so Jabber appeard to be the way to go.
The idea is to set up my own jabber server and if a user sends a message, create an account on the fly, and use that
I have been programming peer 2 peer applications myself and can probably imagine how a jabber server enters the network (looking up common initial meeting points for other servers, scanning ips, getting information from other servers...).
Then later on my server would make known that it can handle messages for all accounts @mydomain.com
But how exactly is the legitimacy verified? All jabber servers just need to have it configured in their config.
I would have imagined a text record in the DNS settings of the domain with a fingerprint of some sort of public key of the server which the emitter of the other jabber server can use to request the reciever to verify its legitimacy before forwarding the message.
However no such thing appears to be the case.
Another way I could think of is just comparing the servers IP address with the one behind the DNS record of the domain.
However this would require the jabber server to be run on the same IP and would make situations with other kinds of records, for example Round-Robin-Ips (like google have) prett complicated. Also it would be vulnerable to a whole series of network level attacks and spoofs.
So whats the deal?
After this (I apologize for that) lengthy introduction, let me sum up my question as:
If a jabber server (A) sends a message from a user to another account on server B, how can A be sure that B really is the right server and not someone spoofing it?
