In <MHEGIFHMACFNNIMMBACAAEIBIDAA(_dot_)sethg(_at_)GoodmanAssociates(_dot_)com>
"Seth Goodman" <sethg(_at_)GoodmanAssociates(_dot_)com> writes:
As a real-world example of the disconnect between the different names, my
mail has a return-path domain of GoodmanAssociates.com, but my provider
(Interland) has their MTA farm under the domain RegisteredSite.com, so I
expect that is what they HELO as. For this setup, _no one_ should ever HELO
with GoodmanAssociates.com, and any mail purporting to be from me better not
have RegisteredSite.com in the return-path.
Ok, yes, your situation is really not much different than
mx.domain.tld vs domain.tld, which is quite common.
The question is: Do you trust Interland to not use
HELO GoodmanAssociates.com from the MTAs? You already trust them not
to abuse your domain name in the 2821.FROM. If you trust them, then
having an different SPF record for 2821.HELO vs 2821.FROM isn't a big
deal. If you don't trust them, then why are you using them?
-wayne