After considering all the discussion, I've filed these three bugs: 4188--RCVD_HELO_IP_MISMATCH should check address literals (this was argued against by Justin, but I'm convinced it's spam-sign)
4186--RCVD_NUMERIC_HELO does not test "reserved" addresses (they are still 'numeric' and aren't hostnames, and should still hit) 4187--RCVD_ILLEGAL_IP does not fire in all cases (reserved, malformed, and literals should all be tested, but aren't) The rest of it can stay where it is and still be useful Thanks -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/