John Jetmore wrote: > On Mon, 6 Nov 2006, Wakko Warner wrote: > > > mind. If the HELO is different, why not verify it? If you have a host that > > is legit doing this, the A record of the HELO should match the IP and you > > could allow that to pass. Most of the HELOs that I have seen are more of > > I've been trying to ignore this thread but this is just such a bad idea > and depends on invalid assumptions. I have what I believe to be a fairly > common mail setup that is perfectly legal but causes a single IP to source > multiple IPs. I have a pool of servers that are used by our billing > system. They are behind a firewall PAT address, so on the public internet > the PAT address appears to be sending SMTP connections with different HELO > strings. > > These servers have valid MX records in DNS. These MX records have > _nothing_ to do with the PAT address. They do _not_ have public A > records because there is no need for them.
I said absolutely nothing about MX records. I said "A" records. > There is nothing illegal about the above configuration, everything that > needs to be valid is valid. But there's nothing tying any of the HELO > strings to the originating PAT address that I can see. Any scheme you > come up with to "validate" the HELO strings (or at least all the ones I've > seen so far) will fail, even though it's all kosher. Sounds to me like you're saying that the name your servers present in HELO do not have an A record (or that the result won't be the IP address that the receiving server sees). In either case, I see that as wrong anyway. Had I configured my server to actually do what I mentioned, I would not be willing to accept mail from hosts that do this. There are far too many spam bots that are consistently giving random and non-verifiable addresses. And yes, I do know about the ones that do a PTR lookup on the zombie's current IP and use that. -- Lab tests show that use of micro$oft causes cancer in lab animals Got Gas??? -- ## List details at http://www.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://www.exim.org/eximwiki/
