Mark Shewmaker wrote:
What sort of non-matching helo strings does hotmail.com send via?
Hotmail says "EHLO hotmail.com". The A records of hotmail.com are 64.4.32.7
and 64.4.33.7. Hotmail does not send mails from these two IP addresses (or
very few).
If your policy is "Check that the HELO string resolves to the incoming IP.
Reject if this is not true *and* the HELO string has an SPF record", then
mail from Hotmail is rejected.
(Do you happen to know how much of the other spf domains are similarly
misconfigured,
No.
or if the number of misconfigured hosts such as *hotmail.com is small
enough to make a temporary trusted-frowarders type workaround feasable?)
Hotmail a trusted forwarded? Never!
Roger