On Tue, 2004-01-20 at 16:59, Hector Santos wrote:
We got a question from a customer saying DNSREPORT.COM
(http://www.dnsreport.com) is reporting a warning abort a host name
mismatch in the greeting. DNSREPORT.COM is a popular SMTP compliancy
testing site.
I just tested it (dnsreport.com "Mail Test") against a qmail-smtpd
replacement I'm working on. The "test" consists of the following
protocol exchange:
220 h.db.org ESMTP ready
<<<< HELO test.DNSreport.com
250 h.db.org
<<<< MAIL
FROM:<tested(_dot_)from(_dot_)80(_dot_)213(_dot_)205(_dot_)88(_at_)DNSreport(_dot_)com>
250 2.1.0 sender
<tested(_dot_)from(_dot_)80(_dot_)213(_dot_)205(_dot_)88(_at_)DNSreport(_dot_)com>
ok
<<<< RCPT TO:<bob(_at_)h(_dot_)db(_dot_)org>
250 2.1.5 recipient <bob(_at_)h(_dot_)db(_dot_)org> ok
<<<< QUIT
221 2.0.0 h.db.org goodbye
I did however discover one thing. I was sending the initial greeting
via 2 write sys-calls. Think of it like this:
write(fd, "220 h.db.org ESMTP ready", 24);
...
...
write(fd, "\r\n", 2);
This confused the "Mail Test" to the point where it claimed not to
have received a valid response. Now I'm no expert, but I can't remember
having read anything that mandates that the whole response be sent in
one TCP packet. With the exception of spam sending malware it doesn't
seem to be a problem for anyone else sending me mail.
Can someone confirm that it is acceptable to send SMTP responses divided
over several TCP packets?
Bob
BTW: As i mentioned, spam zombies seems to have the same problem, so
maybe this could be the next anti-spam trick (for about a week or so,
before the spammers catch up).
--
-=[ B. Johannessen | bob(_at_)db(_dot_)org -=- http://db.org/ | +4797152009 ]=-
-=[ Mail & Spam - News, Drafts & Standards - http://db.org/blog/ ]=-
-=[ On the Origin Of Spam: Spam Statistics - http://db.org/spam/ ]=-