Re: HELO vs. MAIL FROM

Hadmut Danisch wrote:
> 
> Hi,
> 
> I'm still thinking about the proposal to verify
> the host name given in HELO/EHLO instead of
> MAIL FROM sender envelope address.

Why "instead"? Why not give the MTA operator the option
to verify both, or one or the other?

> I agree on two details:
> 
> - It is a good idea to consider the sending MTA as
>   an originator of an error message if the sender
>   envelope address is empty (<>) and to use the
>   given host name (or it's domain part?) instead for the
>   RMX lookup.
> 
> - It does not break any forwarding mechanism.
> 
> But I still believe that the latter one is not an
> advantage, but just a consequence of the malfunction.
> 
> I'll give a real world example:
> 
> This particular message is sent with a sender envelope
> address  <[email protected]>, because I am the originator
> and initiator of the message. correct.

The sender is [email protected].

> But it is delivered to the world through my ISP's relay
> which's host name is sklave3.rackland.de, which is also
> used in the EHLO command.

The relay is sklave3.rackland.de.

> So if you query the RMX record for this name, you'll get
> the RMX record for rackland.de or sklave3.rackland.de.

The (DRIP) lookup should be for sklave3.rackland.de.

> This record will confirm that the authority of rackland.de
> authorizes this machine to be sklave3.rackland.de.

A DNS lookup of sklave3.rackland.de provides this authority/
identity information.

> But how do you want to verify that this machine is authorized
> to deliver mails from danisch.de  if not with the envelope sender
> address?

The HELO based checks _ONLY_ indicate if a domain name used as
a HELO parameter is authorized from the IP address of the SMTP
client. It has nothing to do with the (SMTP MAIL FROM) sender
address. It is a different (type of) verification step.


Raymond S Brand