Alan J. Flavell wrote: > I could add that (rather obviously) the fakers who present a
> particular domain of ours in the HELO are also presenting a recipient
> address in that specific domain. At least, that appears to be the
> regular pattern of their behaviour. So I suppose the proportion of
> each domain that's presented in HELO ought to be measured against the
> number of attempts to spam addresses in that respective domain.
We don't see many HELOs of domains we MX for, apart from the RDNS of
the receiving system. I've not bothered yet to reject on the former;
I do on the latter, plus "localhost", unbracketed-IP,
optionally-signed-decimal-number, and underbar. The latter gets
a customised error message, at MAIL phase - no-one has ever called
us about it though.
Unverifyable HELO names get a delay penalty, and go into a DB for
multiple-names-per-IP checking. Strange how often "every1.net"
appears to be involved......
Known customers, by-IP or by-AUTH, get a free pass.
