On item 1 below: The check does not look at the from domain in the header. The check is before it even sees the from address in the email. It looks at the rDNS of the connection and compares that to what the server announced in the HELO. So if acme.com is sending for foo.com it would HELO mail.acme.com and the receiving server would rDNS the connection to make sure it resolves to mail.acme.com and never care what the 'from' is.
Item 2: What you describe in item 2 (the home dsl) is exactly what I do with my home server. My domain is foo.com but I HELO x.x.x.x.adsl.sbc.net which is the rDNS that SBC has for my static IP address. Here is what the check accomplishes, and it is very effective at it. A large large percentage of the spam we see today is from home cable/dsl users that have been infected with trojans/virus's that allow them to be used as open relays. It is an open relay and of course when it is used it HELO's to the machines it is sending to. It HELO's whatever the virus writer put in the virus in the first place, and there is no way it can match the rDNS since the virus writer had no idea which machines would get infected and which would not. That said, I don't use this check for the reason some one else pointed out, it will reject a TREMENDOUS amount of valid email. I turned it on once at work and watched. Had to turn it off with in 15 minutes the false positive was so high. But, as pointed out earlier SBC does this check and so does AOL so I think you will see it more often and you will see fewer false positives as a result. JK -----Original Message----- From: On Behalf Of Morrison, Gordon Subject: RE: MX records and Reverse DNS lookup I don't see what this accomplishes: 1. where the server is delivering messages for multiple domains. If a company has subsidiaries and brands the email of those subsidiaries with their name (Let's say for example that acme.com owns foo.com). If Acme.com uses it's servers to deliver messages for foo.com, would that be flagged as spam (presuming that whoever is doing this kind level of checking is going to be also checking the sender against the machine domain)? 2. If I am a spammer using home DSL or broadband, and I populate my SMTP server header information with the information gathered by a reverse DNS lookup (or if alternately I use something like dynamic DNS to publish my own DNS information and can update it rapidly), when you resolve the machine name to an IP address, do you accept that as not being spam? If not, how do you get around it? It seems like an odd and not particularly effective means to do any kind of filtering. /Gordon The converse is, if I do register every outgoing server in DNS, I am potentially providing a map of my network which is information the world-at-large doesn't need. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
