On Fri, 22 May 2009, mouss wrote:
John Hardin a écrit :
On Fri, 22 May 2009, Matus UHLAR - fantomas wrote:
I was mentioning cases where someone compares HELO to FQDN and rejects
connections if they do not match. That was indicated by the message (even
with different wording).
Ok, agreed. If they don't match don't reject, just give that a point.
Not as stated. let's say
192.0.2.1 has a PTR of life.example
life.example has an A of 192.0.2.1
easy.example has an A of 192.0.2.1
if an MTA running on 192.0.2.1 helos as easy.example, then it's as good
as any other name he could use. The fact that "life" is not "easy" is
totally irrelevant. (of course, hostnames were chosen to allow for a
word game, but this too is totally irrelevant :)
you can only add a point if you do more checks, such as helo is in AU
and sending IP is in UA, ... etc.
...sigh. Yeah, that's what I was trying to say, without going to the
effort of saying all of it. I agree.
However, a FQDN in the HELO being unresolvable is a valid reason to
reject.
but as I understand the RFCs, it could resolve to anything. an example
would be an MTA behind a NAT box. (note that I am talking about the RFC
requirement, not about what anyone can do with the noise he gets...)
Right. Checking that what it resolves to is reasonable is a more complex
question. Whether or not it resolves at all is a simple question that can
be enforced at SMTP time by the MTA or a milter.
Per RFC2821 3.6 it MUST resolve.
BTW. 2821 and 2822 were updated some time ago. use 5321 and 5322 as
references now.
Thanks.
RFC5321 2.3.5 still requires the domain name in the HELO/EHLO, if used, to
resolve, so that reject is still valid for internet mail.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Public Education: the bureaucratic process of replacing
an empty mind with a closed one. -- Thorax
-----------------------------------------------------------------------
32 days since 9th Circuit incorporated 2nd Amdt - MSM still silent
