Now, these are the rules....
However, I still believe it is perfectly legal to refuse mail if - the HELO matches my own MX, or lists one of my IPs
I guess you mean at the MTA level, not by checking Received headers.
or - the MAIL FROM pretends to be one of my users
This isn't always appropriate:
- one may allow his users to send from outside, without enforcing authentication. I'm talking about inbound mail, not relay.
- one doesn't want to break forwarding ([EMAIL PROTECTED] sends to [EMAIL PROTECTED], the latter has a .forward to redirect mail to [EMAIL PROTECTED] [EMAIL PROTECTED] may belong to the same person, or to different people).
I am currently refusing this stuff at the MTA level and suggest to authenticate (my own users would do that, if they use the server to send mails to each other) So far the only exception is ebay processing where an ebay server tries to send mail FROM a valid user on the system TO the same user (and perhaps to others)
