Jo, > If I get on a random cafe's wireless network, the local hosts might be in > 192.168.1.0/24. Should I allow them to relay mail? Should I allow their > outbound mail to bypass spam check? Absolutely not, I'm sure you would > agree.
host/link/site -local IP addresses and private addressess are *not* routable outside their scope. You can't receive/establish a TCP session from such IP address from outside on your MX mailer. On an inbound connection your MX MTA prepends a Received header field to a mail header, carrying in a 'from' field a client's IP address - which *is* a public address, otherwise the connection would not be established (nonroutable). When analyzing a mail header (top to bottom), SpamAssassin breaks a trust chain on encountering a 'received from' carrying an IP address not in your trusted_networks. Anything beyond that does not matter, further Received trace header fileds would not be trusted even if they carry an IP address matching the trusted_networks. It is exactly the same argument why one can and should safely include the 127.0.0.0/8 in the trusted_networks list. The same applies to private address ranges and link-local address space. Mark
