Re: Re: Exim 4.41 + Exiscan 4.41-24 + libspf2 1.0.4

On Aug 5, 2004, at 11:15 AM, Peter Bowyer wrote:

> Scott Amory <[email protected]> wrote:
>> I just noticed this the other day too.  So I dug around in the Exiscan
>> patch and in the libspf2 library to find out why.  It appears that
>> Exiscan waits for the HELO/EHLO to send its spf_init call which sets
>> up stuff so that it can run the SPF check.  Part of the reason for
>> this I would imagine is that spf_init calls SPF_set_helo_dom.  The
>> spf library uses the HELO/EHLO domain as a backup if it can't find
>> one in the MAIL FROM.  So it's not really required but for some
>> reason Exiscan makes it required.  To see If I could get the SPF
>> check to work without a HELO/EHLO I patched the Exiscan patch with
>> some changes and it seemed to work, though I haven't done extensive
>> testing on it yet.  Now Exiscan will perform on an SPF check (that
>> should work) even when it doesn't get a HELO/EHLO.  Can anyone see a
>> reason why this would be a bad idea?
>
> Yes. The HELO/EHLO name is a *required* input to the SPF algorithm, 
> and is
> used in the case of null senders. I suppose Exiscan could assume some
> pre-determined result if it doesn't have all the required values, but 
> it
> wouldn't be following SPF properly.
>
> Peter

Thanks for the quick reply. Could you point out where it says its 
required? I'm looking through the RFC and I'm having trouble finding 
that.  All I can see is spots that say that it may be used for checks. 
It seems to me though that anyone can get around Exiscan/spf2's method 
of SPF checking by simply not sending a HELO/EHLO unless one makes it 
required for sending mail. It just seems to make sense to me that if we 
can check it without the HELO/EHLO then we should.

Scott