Good point. What I was trying to suggest was that if a spammer did a reverse DNS lookup of their IP address as provided by their ISP (or broadband provider as is probably the case), they could then populate the information provided in the EHLO command with that reverse lookup name.
Any receiving system trying to verify that the sending system is legitimate using the information in the SMTP transmission would find that the information matched, and allow it through, even though it was a spammer. If they took it a step further and verified that the domain of the sender matched the domain of the server, they would be preventing messages coming from legitimate companies who host multiple domains on a single server. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ben Winzenz Sent: Thursday, July 01, 2004 2:39 PM To: Exchange Discussions Subject: RE: MX records and Reverse DNS lookup Keep in mind that dynamic DNS will not update PTR records. Most often (especially in the case of home DSL), the IP range is owned by the ISP, and the ISP must configure the reverse-lookup record. I'd say probably 99% of the time, in that case, they will not configure one specifically for you, so your PTR record will not match your host name. It's very different that hosting DNS for a specific domain, where you can control who owns the DNS zone. You don't have much control over the reverse-lookup zone. Ben Winzenz, MCSE MS Exchange MVP MessageOne -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Morrison, Gordon Posted At: Thursday, July 01, 2004 1:32 PM Posted To: swynk Conversation: MX records and Reverse DNS lookup Subject: RE: MX records and Reverse DNS lookup I don't see what this accomplishes: 1. where the server is delivering messages for multiple domains. If a company has subsidiaries and brands the email of those subsidiaries with their name (Let's say for example that acme.com owns foo.com). If Acme.com uses it's servers to deliver messages for foo.com, would that be flagged as spam (presuming that whoever is doing this kind level of checking is going to be also checking the sender against the machine domain)? 2. If I am a spammer using home DSL or broadband, and I populate my SMTP server header information with the information gathered by a reverse DNS lookup (or if alternately I use something like dynamic DNS to publish my own DNS information and can update it rapidly), when you resolve the machine name to an IP address, do you accept that as not being spam? If not, how do you get around it? It seems like an odd and not particularly effective means to do any kind of filtering. /Gordon The converse is, if I do register every outgoing server in DNS, I am potentially providing a map of my network which is information the world-at-large doesn't need. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander Kooi Sent: Thursday, July 01, 2004 12:55 PM To: Exchange Discussions Subject: RE: MX records and Reverse DNS lookup SBD does it now. So if you have yours setup in a way that doesn't conform you're going to start having a good sized chunk of mail not reach it's intended recipient. And it's just going to get worse over time. It's very simple to set an rDNS entry that matches your HELO though, so I'm not sure it's a huge deal. Just something that all Exchange and Network admins need to be aware of. -----Original Message----- From: Ken Cornetet [mailto:[EMAIL PROTECTED] Sent: Thursday, July 01, 2004 11:37 AM To: Exchange Discussions Subject: RE: MX records and Reverse DNS lookup To all who consider rejecting an SMTP connection based on what's in the HELO command, you WILL start rejecting valid email: If you reject connections based on no PTR record for the connecting IP, you will reject a little valid email. If you reject based on the PTR record not matching the host name in the HELO, you will reject a lot of valid email. Thus the prophets spoke in RFC2821 verse 4.1.4 An SMTP server MAY verify that the domain name parameter in the EHLO command actually corresponds to the IP address of the client. However, the server MUST NOT refuse to accept a message for this reason if the verification fails: the information about verification failure is for logging and tracing only. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim Kennedy Sent: Thursday, July 01, 2004 10:54 AM To: Exchange Discussions Subject: RE: MX records and Reverse DNS lookup What most of them are doing is looking at the PTR record of the sending IP and compare it to what you announce in your HELO. And making sure they match. They do this because it is very effective at weeding out zombied machines. The SMTP HELO of the infected machine is not going to match the PTR of the IP. What they are doing is suggested by the RFC's, but not required. So this is an easy fix for you. Just look at the PTR of each of your public IP addresses that your email servers use. Then go into Exchange and adjust the HELO to match. Hopefully you have exchange 2003, it is a really easy fix. It is in the SMTP properties as 'masquerade domain' JK -----Original Message----- From: On Behalf Of April Fleming Subject: MX records and Reverse DNS lookup It is my understanding that many email servers will do a reverse dns lookup on incoming email to ensure a valid domain when sifting out spam etc. Thus, I must ensure that my email server which is sending out email must have an MX record so the Reverse DNS lookup will suceed. What I would like to know is whether the weight given the MX record will affect the reverse dns lookup. If I have email being sent from email server 3 (don't ask why, it isn't the point :) and that email server is weighted 15, will the email servers I am sending out to accept the email? Example MX 5 Email server 1 MX 10 Email server 2 MX 15 Email server 3 Thank you! April _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. ___________________NOTICE____________________________ This electronic mail transmission contains confidential information intended only for the person(s) named. Any use, distribution, copying or disclosure by any other person is strictly prohibited. If you received this transmission in error, please notify the sender by reply e-mail and then destroy the message. Opinions, conclusions, and other information in this message that do not relate to the official business of Bain & Company shall be understood to be neither given nor endorsed by the Company. When addressed to Bain clients, any information contained in this e-mail is subject to the terms and conditions in the governing client contract. _______________________________________ _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. ___________________NOTICE____________________________ This electronic mail transmission contains confidential information intended only for the person(s) named. Any use, distribution, copying or disclosure by any other person is strictly prohibited. If you received this transmission in error, please notify the sender by reply e-mail and then destroy the message. Opinions, conclusions, and other information in this message that do not relate to the official business of Bain & Company shall be understood to be neither given nor endorsed by the Company. When addressed to Bain clients, any information contained in this e-mail is subject to the terms and conditions in the governing client contract. _______________________________________ _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
