On Sat, 2004-12-11 at 02:31, David wrote:
We don't *need* to use SPF to authenticate HELO. Having HELO be a FQN that
resolves to the IP of the MTA authenticates the MTA equally as well
as an SPF record - as is recommended practice.
nowadays most mta's fail this condition
But how often do they fail (for the non-forgery cases), when the HELO
string has an SPF record?
Does anyone know?
If it's impractical to say:
o Check that the HELO string resolves to the incoming IP and reject
if this is not true,
Would it be practical to say:
o Check that the HELO string resolves to the incoming IP. Reject
if this is not true *and* the HELO string has an SPF record.
That would be an ideal solution!
--
Mark Shewmaker
mark(_at_)primefactor(_dot_)com