Re: HELO vs. MAIL FROM

Hadmut Danisch <[email protected]> wrote:
> Two questions:
> 
> - Where do we look for RMX/SPF/DRIP/DMP? Do we look at the full 
>   hostname or do we cut off the hostname?

  We look at the domain for the host name, and ask that domain about
the IP address which claimed to be a host in that domain.

>   Example: HELO sklave3.rackland.de
> 
>   Do we search in the DNS zone of sklave3.rackland.de or 
>   rackland.de? Or do we rekursively descend until we have
>   2 (or 3 for e.g.  co.uk or com.au) remaining domain components?

  We strip off the machine name, and only the machine name.

  e.g. I have a machine 'giles.striker.ottawa.on.ca'.  I've had
bounces from idiot mailers, because they claim that 'ottawa.on.ca'
doesn't have an MX, and doesn't know about 'striker.ottawa.on.ca'.

  We can assume that the name in the EHLO/HELO is a host name,
followed by a domain.  We can make NO assumptions about that domain.

> - Verifying the EHLO name only _is_ an open door for spamming. It
>   does allow identification, but not blocking. 

  Blocking is something which may be done in addition to ASRG-RMX.

  e.g. You may query a blacklist based on domain names, BEFORE doing
an ASRG-RMX query to that domain.  This allows well-known spammers to
be blacklisted, and prevents the MTA from discovering that the spammer
consents to sending spam from that IP.

  Alan DeKok.