This may or may not be the case though, this was something from back in September that was first prompted by John and Bill, and I coded it up before I had access to WHITELIST AUTH.
I think the important lesson is to understand that there are often exceptions. This filter has hit some of my customers who have boxes doing automated notifications with their own SMTP engine (such as Windows 2003), and if you gateway for customers, you either need to whitelist their server or exclude them from this list. I use an IS match to limit the potential of false positives.
Matt
Lyndon Eaton wrote:
Yes Kevin I think you would be right. A Netscape/Mozilla user sending mail through another ISP for a domain on my server may pass the 'sending' domain in its HELO to the server, but that server should then not pass the same onto my server - if it did I guess that ISP would have big problems.
And if a local user was using Netscape, there would be no reason for
them not to SMTP AUTH, meaning they'd be whitelisted.
Mat would you agree?
Kevin, as I whitelist my IP range anyway, would I need the WHITELIST AUTH? If the 'Netscape/Mozilla' user were in that range?
-----Original Message----- From: Kevin Bilbee [mailto:[EMAIL PROTECTED] Sent: 17 March 2004 20:55 To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Block on HELO
If an ISP SMTP server is dynamically changing their HELO to what it
receives from the cleint then the ISP has the issue. The hello from an
ISP should be a valid host name with an IP address or the ISP's domain
name with an MX record.
I have been running the HELO test since DECLUDE started supporting IMail auth and have 0 reported incidents of a false positive.
All the articles I read all say the same thing use SMTP auth when filtering the HELO on local domain names.
Kevin Bilbee
************************************************
Email checked by UKsubnet anti-virus service To prevent email abuse & block spam contact [EMAIL PROTECTED] Tel: +44(0)8712360301 Web: www.uksubnet.net
Fax: +44(0)8712360300
Powered by UKsubnet Internet Service Provider Business to Business Internet (ISP) ************************************************
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
