https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6169





--- Comment #6 from Sidney Markowitz <[email protected]>  2009-07-30 15:12:36 
PST ---
(reply to comment #5)

Whoops, I had bad information on the meaning of "may be forged", your quote
from the sendmail documentation is more authoritative.

On the other hand, I don't think that "may be forged" as described there should
be a reason to not match whitelist_from_rcvd. Some ISPs have multiple ip
addresses for a host name as a form of load balancing. If mx.example.com
returns different addresses at different times for a DNS query, all of those
addresses should return mx.example.com for rdns, but the forward query may not
match. In that case, you have a good chance of getting a "may be forged". Your
whitelist_from_rcvd entry must look for whatever is returned by the rdns query
for the ip address that the mail comes from, but there is no guarantee that
will be the only or the primary ip address for that host name.

So I was wrong about the details of why it was happening, but not about the
rest of it: Under normal circumstances a spammer uses different From addresses,
so they can not practically use a bogus rdns entry on their mail server to make
it look like the correct server is sending the mail for that From address.
whitelist_from_rcvd doesn't really have to care about the "may be forged" as
there isn't a practical way to get a useful forgery in the general case.
However. "localhost" may be a useful forgery for the spammer just because of
situations like this.

I suppose that if Spamassassin could handle an ip address in a
whitelist_from_rcvd, then you could specify 127.0.0.1 just for this situation.
Is that what your non-forged Received headers have when you really do send mail
to yourself on your machine? Perhaps that would be a useful enhancement if it
isn't handled already (I haven't looked it up or tried it yet).

-- 
Configure bugmail: 
https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

Reply via email to