spf-discuss
[Top] [All Lists]

Re: Possible SPF machine-domain loophole???

2004-02-25 12:55:18
--On Dienstag, Februar 24, 2004 17:41:21 +0000 Brian Candler <B(_dot_)Candler(_at_)pobox(_dot_)com> wrote:
[...]
In which case there must be an easier way? Like a BCP which says don't
include HELO names in Received: headers?

Take a look at RFC2821:

| 4.4 Trace Information
|
|    When an SMTP server receives a message for delivery or further
|    processing, it MUST insert trace ("time stamp" or "Received")
|    information at the beginning of the message content, as discussed in
|    section 4.1.1.4.
|
|    This line MUST be structured as follows:
|
|    -  The FROM field, which MUST be supplied in an SMTP environment,
|       SHOULD contain both (1) the name of the source host as presented
|       in the EHLO command and (2) an address literal containing the IP
|       address of the source, determined from the TCP connection.

So RFC2821 states exactly the opposite of your suggestion: unless you
know exactly what you are doing, the consequences this will cause *and*
have very strong reasons for doing it, you should *not* omit the name
given as EHLO parameter from the Received:-line you generate.

Ralf