Re: HELO vs. MAIL FROM

Alan DeKok wrote:
> 
> Hadmut Danisch <[email protected]> wrote:
> > Two questions:
> >
> > - Where do we look for RMX/SPF/DRIP/DMP? Do we look at the full
> >   hostname or do we cut off the hostname?
> 
>   We look at the domain for the host name, and ask that domain about
> the IP address which claimed to be a host in that domain.
> 
> >   Example: HELO sklave3.rackland.de
> >
> >   Do we search in the DNS zone of sklave3.rackland.de or
> >   rackland.de? Or do we rekursively descend until we have
> >   2 (or 3 for e.g.  co.uk or com.au) remaining domain components?
> 
>   We strip off the machine name, and only the machine name.

The "machine name" may be the "domain name". I've also seen sites
where the "machine name" was more than one domain component.

>   e.g. I have a machine 'giles.striker.ottawa.on.ca'.  I've had
> bounces from idiot mailers, because they claim that 'ottawa.on.ca'
> doesn't have an MX, and doesn't know about 'striker.ottawa.on.ca'.
> 
>   We can assume that the name in the EHLO/HELO is a host name,
> followed by a domain.  We can make NO assumptions about that domain.

Bad assumption, the "host name" can be the "domain name".

> > - Verifying the EHLO name only _is_ an open door for spamming. It
> >   does allow identification, but not blocking.
> 
>   Blocking is something which may be done in addition to ASRG-RMX.
> 
>   e.g. You may query a blacklist based on domain names, BEFORE doing
> an ASRG-RMX query to that domain.  This allows well-known spammers to
> be blacklisted, and prevents the MTA from discovering that the spammer
> consents to sending spam from that IP.



Raymond S Brand