LuKreme wrote:
On 30-Mar-2009, at 13:20, Carlos Williams wrote:
Received: from 59.165.5.205.man-static.vsnl.net.in (unknown
[59.165.5.205])
by mail.ideorlando.org (Postfix) with ESMTP id 910AA1FA4D9E
for <[email protected]>; Mon, 30 Mar 2009 10:32:52 -0400 (EDT)
There are so many spam warnings in that header...
/^unknown$/ REJECT helo No unknown hostnames
in your helo checks is a fantastic idea.
"unknown" isn't the helo, it's an unknown client. This client
could be rejected with reject_unknown_client_hostname, but
that rejects too much legit mail for most sites.
Rejecting IP looking DNS names is a good idea too
Something like this:
/(d{1,3}[.-]){3}[.-]\d{1,3}/ REJECT Too many numbers in your hostname
That would work as a check_helo_access map, but note the
client used this as a HELO hostname, not a DNS entry. This is
"mostly" safe as a helo check.
One could also use this in a
check_reverse_client_hostname_access table, but would likely
reject too much legit mail.
-- Noel Jones
