Re: HELO vs. MAIL FROM

Hadmut Danisch wrote:
> 
> On Wed, Oct 22, 2003 at 12:02:30PM -0500, Gordon Fecyk - Home wrote:
> >
> > * If not, or if non-participant, or if null sender, check HELO'd hostname to
> > see if it's allowed to send mail for itself.  If so, accept the mail.  If
> > not, bounce it, tag it, or do something else.
> >
> > It's a little weaker than purely authenticating against MAIL FROM, and it
> > would allow some spam through, but it would clearly point the finger at
> > who's accountable - the admins of the server that HELO'd itself.  And it
> > would allow .forward.
> 
> Two questions:
> 
> - Where do we look for RMX/SPF/DRIP/DMP? Do we look at the full
>   hostname or do we cut off the hostname?
> 
>   Example: HELO sklave3.rackland.de
> 
>   Do we search in the DNS zone of sklave3.rackland.de or
>   rackland.de? Or do we rekursively descend until we have
>   2 (or 3 for e.g.  co.uk or com.au) remaining domain components?

The DRIP method is to use sklave3.rackland.de when looking for a
positive result, and if that lookup fails, begin checking that parent
domains with the result being negative if any of the parent domains
have a positive or negative lookup.

> - Verifying the EHLO name only _is_ an open door for spamming. It
>   does allow identification, but not blocking.

You _CAN_ block based on the SMTP HELO parameter. It's just another
DNSBL.

>   What do we do?
> 
>     - Yes, we do it.
>     - No, we don't want it.
>     - Nice, it's the recipient's decision whether or not.
>     - Nice, it's the envelope sender domain's decision whether
>       or not (I'd propose to have a special entry in the RMX
>       record which tell's whether or not).

Ultimately, it's the server MTA operator's decision which, or
both, checks are performed.


Raymond S Brand