Re: exim HELO=fully qualified host name?
On 2004-03-01 15:08:17 -0500, Derrick 'dman' Hudson wrote:
> On Sun, Feb 29, 2004 at 10:16:23PM +0100, Vincent Lefevre wrote:
> | RFC 2821:
> |
> | An SMTP server MAY verify that the domain name parameter in the EHLO
> | command actually corresponds to the IP address of the client.
> | However, the server MUST NOT refuse to accept a message for this
> | reason if the verification fails: the information about verification
> | failure is for logging and tracing only.
>
> You have a nice Catch-22 here. The receiver is not allowed to reject
> bad data, but the sender isn't allowed to send it either!
This isn't necessarily bad data. Some machines have several interfaces,
i.e. several IP addresses, and several FQDNs may resolve to the same
IP address; so, the FQDN and the IP address seen by the server won't
always match. Same problems with machines on private networks, when
NAT is used.
> It boils down to what you, as a receiver, find acceptable. I find
> requiring the HELO to be syntactically correct and fully-qualified to
> be effective at limiting junk (spam and viruses) while not causing
> significant collateral damage. I think requiring the name to resolve
> to the same address as the client connecting is being too strict. In
> fact, I have found that requiring the name to resolve to anything
> creates too much collateral damage. YMMV.
Well, I think that requiring a FQDN (i.e. with at least a dot) is even
too much, as the FQDN is completely useless and most spam messages are
sent with a valid FQDN anyway.
--
Vincent Lefèvre <vincent@vinc17.org> - Web: <http://www.vinc17.org/> - 100%
validated (X)HTML - Acorn Risc PC, Yellow Pig 17, Championnat International
des Jeux Mathématiques et Logiques, TETRHEX, etc.
Work: CR INRIA - computer arithmetic / SPACES project at LORIA
Reply to: