Re: [exim] Hostnames

John Jetmore wrote:
> On Mon, 6 Nov 2006, Wakko Warner wrote:
>
> > mind. If the HELO is different, why not verify it? If you have a host that
> > is legit doing this, the A record of the HELO should match the IP and you
> > could allow that to pass. Most of the HELOs that I have seen are more of
>
> I've been trying to ignore this thread but this is just such a bad idea
> and depends on invalid assumptions. I have what I believe to be a fairly
> common mail setup that is perfectly legal but causes a single IP to source
> multiple IPs. I have a pool of servers that are used by our billing
> system. They are behind a firewall PAT address, so on the public internet
> the PAT address appears to be sending SMTP connections with different HELO
> strings.
>
> These servers have valid MX records in DNS. These MX records have
> _nothing_ to do with the PAT address. They do _not_ have public A
> records because there is no need for them.

I said absolutely nothing about MX records. I said "A" records.

> There is nothing illegal about the above configuration, everything that
> needs to be valid is valid. But there's nothing tying any of the HELO
> strings to the originating PAT address that I can see. Any scheme you
> come up with to "validate" the HELO strings (or at least all the ones I've
> seen so far) will fail, even though it's all kosher.

Sounds to me like you're saying that the name your servers present in HELO
do not have an A record (or that the result won't be the IP address that the
receiving server sees). In either case, I see that as wrong anyway. Had I
configured my server to actually do what I mentioned, I would not be
willing to accept mail from hosts that do this. There are far too many spam
bots that are consistently giving random and non-verifiable addresses. And
yes, I do know about the ones that do a PTR lookup on the zombie's current
IP and use that.

--
Lab tests show that use of micro$oft causes cancer in lab animals
Got Gas???