From owner-freebsd-arch Wed Aug 23 7:51:13 2000 Delivered-To: freebsd-arch@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id C15FD37B424; Wed, 23 Aug 2000 07:51:05 -0700 (PDT) Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.9.3/8.9.3) with SMTP id KAA19974; Wed, 23 Aug 2000 10:51:04 -0400 (EDT) (envelope-from robert@fledge.watson.org) Date: Wed, 23 Aug 2000 10:51:03 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org To: Mike Smith Cc: Brian Fundakowski Feldman , Darren Reed , "Jordan K. Hubbard" , root@ihack.net, freebsd-sparc@freebsd.org, freebsd-arch@freebsd.org Subject: Re: Competition In-Reply-To: <200008221832.LAA20960@mass.osd.bsdi.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-arch@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Tue, 22 Aug 2000, Mike Smith wrote: > Actually, "ihack.net" *is* being blocked. Because it's not set up > correctly. > > Aug 22 00:21:34 hub postfix/smtpd[42146]: connect from r94aag002979.sbo-smr.ma.c > able.rcn.com[209.6.183.136] > Aug 22 00:21:35 hub postfix/smtpd[42146]: 5567A37B42C: client=r94aag002979.sbo-s > mr.ma.cable.rcn.com[209.6.183.136] > Aug 22 00:21:37 hub postfix/smtpd[42146]: reject: RCPT from r94aag002979.sbo-smr > .ma.cable.rcn.com[209.6.183.136]: 450 : Helo command rejected > : Host not found; from= to= Actually, the check of the "helo" field is something I'd like removed: it makes life very difficult for hosts behind NATs without proper SMTP proxies (such as default installs of our natd, which does not include an SMTP proxy :-). It's not possible to send-pr from internal machines behind my NAT without having world-visible DNS names for all my internal machines. RFC 821 doesn't specify criteria under which HELO should be rejected, although it does allow for that possibility with the following errors: HELO S: 250 E: 500, 501, 504, 421 It's useful also to note that 450 is not among them :-). While part of RFC 821 refers to it as a "domain name", the text also refers to it as the "host name" of the sender. I have a rather dim view of NATs based on this kind of problem, but unfortunately NATs are a reality, and there are many hosts mail-delivering behind NATs. :-) I'm fine with the other legitimacy tests--sender email address must resolve, sender host must have a valid reverse/forward lookup pair, etc, but the HELO check causes me a lot of trouble, and no doubt others. Robert N M Watson robert@fledge.watson.org http://www.watson.org/~robert/ PGP key fingerprint: AF B5 5F FF A6 4A 79 37 ED 5F 55 E9 58 04 6A B1 TIS Labs at Network Associates, Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message