RE: A Quickhack

> >   When receiving a EHLO/HELO command, do an A query to the
> >   given parameter and abort if the response does not match
> >   the IP address.
>
>   RFC 2821, Section 4.1.4, Paragraph 6 says:
>
>    An SMTP server MAY verify that the domain name parameter in the
>    EHLO command actually corresponds to the IP address of the client.
>    However, the server MUST NOT refuse to accept a message for this
>    reason if the verification fails: the information about
>    verification failure is for logging and tracing only.

This is one of those time I think it's better to practice civil
disobedience.

What about if other tests fail as well?  Such as checking MAIL FROM and
EHLO?   I'm thinking a site could check MAIL FROM and if that's rejected,
check EHLO, and if that's rejected TOO, then bounce it.  Or whatever order
they're checked, as long as they both are rejected.

I'm using "rejected" instead of "failed" because a failure to look something
up is a different state.  In DNS you can have SERVFAIL and NXDOMAIN, which
are unique conditions.  The former, for a valid domain, is almost always a
temporary error.

--
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email protected]>
What's a PGP Key?  See <http://www.pan-am.ca/free.html>
GOD BLESS AMER, er, THE INTERNET. <http://vmyths.com/rant.cfm?id=401&page=4>

--
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email protected]>
What's a PGP Key?  See <http://www.pan-am.ca/free.html>
GOD BLESS AMER, er, THE INTERNET. <http://vmyths.com/rant.cfm?id=401&page=4>