Well, I think one of your examples had the remote announcing itself as some IP address, [nn.nn.nn.nn]. It may have failed the Invalidate HELO, which (I believe) as delivered in 1.2.6, specifically triggered on IP based HELOs. Recall Fritz's 4 HELO tests, but specifically see:
> invalid helo - uses rfc rules in regex to determine if a helo is > invalid If you look on the Web Admin screen of 1.2.6, the two items of interest, under "Validate Sender" are: "Invalidate Format of HELOs" "Expression to Invalidate Format of HELO" Do you have "Invalidate Format of HELOs" activated? Michael Thomas Mathbox 978-683-6718 1-877-MATHBOX (Toll Free) > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Patrick Butts > Sent: Sunday, February 25, 2007 4:35 PM > To: Questions and Answers for users of ASSP Anti-Spam SMTP Proxy > Subject: Re: [Assp-user] SPAM-BLACKLIST:Re: Frustrated - Forged Helo > > Michael Thomas - Mathbox wrote: > >> forged helos - looks for local domains, host and ips in connecting > >> server > >> > > > > To expand on Fritz's explanation, of forged helos, use the > example of ASSP > > on my mail server. ASSP is running on its own IP address, > 63.150.236.20, > > with the name smtp01.mathbox.net. If a remote mail server > connects to ASSP > > on my mail server and announces in its HELO that it is > smtp01.mathbox.net, > > then its HELO is forged, because the remote mail server > CANNOT be me. In the > > same manner, if the remote mail server announces in its > HELO that it is > > [63.150.236.20], then its HELO is forged, because again, it > CANNOT be me. > > > So all these Helo Forged entries I'm getting in the logs are > technically > incorrect (with 1.2.6). I haven't looked since I've upgraded > to 1.3. > They aren't announcing themselves as anything I have in my > "myServerRe". They may be invalid but they weren't forged... > > I'll keep an eye on it with 1.3 and see if it has changed, > got fixed, or > whatever. > > > -------------------------------------------------------------- > ----------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the > chance to share your > opinions on IT & business topics through brief surveys-and earn cash > http://www.techsay.com/default.php?page=join.php&p=sourceforge > &CID=DEVDEV > _______________________________________________ > Assp-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/assp-user > > ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
