Well, I think one of your examples had the remote announcing itself as some
IP address, [nn.nn.nn.nn]. It may have failed the Invalidate HELO, which (I
believe) as delivered in 1.2.6, specifically triggered on IP based HELOs.
Recall Fritz's 4 HELO tests, but specifically see:

> invalid helo - uses rfc rules in regex to determine if a helo is
> invalid

If you look on the Web Admin screen of 1.2.6, the two items of interest,
under "Validate Sender" are:

"Invalidate Format of HELOs"
"Expression to Invalidate Format of HELO"

Do you have "Invalidate Format of HELOs" activated?

Michael Thomas
Mathbox
978-683-6718
1-877-MATHBOX (Toll Free)
  

> -----Original Message-----
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of 
> Patrick Butts
> Sent: Sunday, February 25, 2007 4:35 PM
> To: Questions and Answers for users of ASSP Anti-Spam SMTP Proxy
> Subject: Re: [Assp-user] SPAM-BLACKLIST:Re: Frustrated - Forged Helo
> 
> Michael Thomas - Mathbox wrote:
> >> forged helos - looks for local domains, host and ips in connecting
> >> server
> >>     
> >
> > To expand on Fritz's explanation, of forged helos, use the 
> example of ASSP
> > on my mail server. ASSP is running on its own IP address, 
> 63.150.236.20,
> > with the name smtp01.mathbox.net. If a remote mail server 
> connects to ASSP
> > on my mail server and announces in its HELO that it is 
> smtp01.mathbox.net,
> > then its HELO is forged, because the remote mail server 
> CANNOT be me. In the
> > same manner, if the remote mail server announces in its 
> HELO that it is
> > [63.150.236.20], then its HELO is forged, because again, it 
> CANNOT be me.
> >   
> So all these Helo Forged entries I'm getting in the logs are 
> technically 
> incorrect (with 1.2.6).  I haven't looked since I've upgraded 
> to 1.3.  
> They aren't announcing themselves as anything I have in my 
> "myServerRe".  They may be invalid but they weren't forged...
> 
> I'll keep an eye on it with 1.3 and see if it has changed, 
> got fixed, or 
> whatever.
> 
> 
> --------------------------------------------------------------
> -----------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the 
> chance to share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge
> &CID=DEVDEV
> _______________________________________________
> Assp-user mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/assp-user
> 
> 


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user

Reply via email to