Re: Which ACLs to use

Michael F. Sprague <[email protected]> wrote:
> Hi folks,
>
> I'm looking for some opinions on which ACLs to use.  For example, I
> would like to reject connections when the sender tries to forge my IP
> address in the HELO/EHLO statement.  I would have figured the best
> place to do this would be in the acl_smtp_helo ACL.  I did some
> research and most examples I found were in not in the acl_smtp_helo
> ACL.
>
> Would it not be a good idea to do sender verification in the
> acl_smtp_mail ACL?
>
> Is it generally better to do as many 'rejections' as possible in the
> acl_smtp_rcpt ACL b/ most MTAs will handle that better?  Is there any
> other reason, except for compatiblity with dumb MTAs, to not make use
> of the other ACLs?

You've answered your own question pretty well. Remember, it's not
well-behaved MTAs you're rejecting from in the main, it's spamware. And
various forms of spamware are known to react badly to a 550 reponse to HELO.
Popular wisdom says you should wait until the RCPT and reject then.

In addition, if you wait until the RCPT phase you then have all the
information you are going to get about the connection at very little extra
expense, and can make decisions based on combinations of things if you
choose.

Peter