Who knows? Perhaps HELO checking and enforcement is
incredibly important.
It could be. I just don't have any data to back that up.
I approached HELO as a way to check delivery status notification messages
(MAIL FROM:<>). At one point this was a popular way to get past early spam
filters and RFC 2821 still requires accepting this envelope. So I only
wanted to check HELO if the envelope was null, to make sure the message
really came from a MTA as opposed to a user.
That being said I do see a lot of "HELO MACHINE-NAME" coming from MTAs (not
just MUAs run by users, but MTAs too). It isn't normally what I see but it's
there. I find it's usually because the machine doesn't know the domain it
belongs to and it can be fixed by telling it. Other MTAs have a HELO or EHLO
string setting they can change.
While MUAs often don't know what domain they're in and just HELO MACHINENAME
all the time, allowed networks or AUTH should be able to override any
LMAP-type checks so they can send mail through that server. The HELO check
becomes moot. I'm only interested in an outside MTA's HELO, and again only
if the RFC 2821 envelope is null.
--
PGP key (0x0AFA039E):
<http://www.pan-am.ca/consulting(_at_)pan-am(_dot_)ca(_dot_)asc>
What's a PGP Key? See <http://www.pan-am.ca/free.html>
GOD BLESS AMER, er, THE INTERNET. <http://vmyths.com/rant.cfm?id=401&page=4>