On 01/02/2018 01:18 AM, Benoit Panizzon wrote:
I seem to observe, that more servers have started rejecting email because of 'helo / hostname' mismatch.
Please clarify what you're talking about matching. There are three names that come to mind: SMTP's HELO / EHLO name, the A / AAAA (/ CNAME) record that resolves to the IP, and the PTR record that resolves to a name. (No, you shouldn't use CNAMEs in an MX record, but people do anyway, often wondering why things don't always work.)
I personally have always kept the three names in sync with each other.I have heard of more people filtering on this, even though it's discouraged (if not outright forbidden by RFC.)
If for example, you run a mailman installation with virtual domains enabled and use SSL for the Web-Management part, you have one ip address per domain.
You may not even have one IP address per domain if you're using Server Name Indication to for HTTPS.
There is no strict correlation between the name that the MTA knows itself as with the domain names that the MTA handles email for.
sendmail or whatever MTA is used, will probably listen to all ip addresses and pick the one belonging to the domain for email sending, but still the hostname used in the EHLO is the one of the physical machine and not the virtual domain.
Sendmail is fairly flexible in that you can both specify what name is used and what IP / interface / Daemon Port is used. - I believe that you can also tune Sendmail to send email out the same Daemon Port that received the message if you are wanting to correlate names with IPs.
I did a quick check of the SMTP RFCs, I could not find anything that requires the EHLO domainnamen to match the connecting IP address.
If the names do differ, I would be careful to make sure that all the names are SPF compliant.
So what is your opinion, is it legit to reject email because the ehlo domain does not match the connection ip's PTR record?
I have not felt the need to filter based on such tests. - I have always been able to filter on other criteria.
I would gently suggest to someone that they not filter based on such today. - That may change in 5 ~ 10 years. Much like requiring Reverse DNS, or that forward and reverse DNS corroborate each other, was once frowned upon by more people than do so today.
-- Grant. . . . unix || die
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
