Re: A Quickhack

Hadmut Danisch <[email protected]> wrote:
> We could cover the hole EHLO/HELO story by simply giving out this
> recommendation:
> 
>   When receiving a EHLO/HELO command, do an A query to the 
>   given parameter and abort if the response does not match 
>   the IP address.

  RFC 2821, Section 4.1.4, Paragraph 6 says:

   An SMTP server MAY verify that the domain name parameter in the
   EHLO command actually corresponds to the IP address of the client.
   However, the server MUST NOT refuse to accept a message for this
   reason if the verification fails: the information about
   verification failure is for logging and tracing only.

  We don't want our proposals to violate RFC 2821.

  In addition, there's no reason why there should be any correlation
between IP address and host name.  Many people put SMTP servers behind
NAT gateways, for example.

  All that is required for RMX is that the domain has a statement that
this IP is permitted to use SMTP, and to claim to be from the domain.
That's quite a different statement than "this hostname corresponds to
this IP"

  Alan DeKok.