Blocking on HELO (was Re: [Mimedefang] filter_relay)

[Mike Lambert]

On Mon, 1 Nov 2004, David F. Skoll wrote:

> That's true.  But a very narrow block can block a lot of spam.  My mail
> server (mail.roaringpenguin.com) has IP address 206.191.13.82.
<..>
> The maillog covers about 36 hours.  That means that more than once an hour,
> some random host claims to be *my* IP address (206.191.13.82) in its HELO.
> I block all of those and haven't had a complaint yet.

As do I. Blocking HELO claiming to be my domain works well also.

> (If you were pedantic, you'd block a host that uses any kind of naked
> IP address in HELO, because it really should use [ip.addr.of.host]
> with the square brackets.)

I tried that but rejected good email from a few broken mail servers. :-(

Regards,
Mike Lambert