On Tue, 28 Jul 2015 14:27:45 -0600 Philip Prindeville <philipp_subx at redfish-solutions.com> wrote: > Am I correctly seeing that filter_helo() is being called twice for > the same connection? Looks that way. I bet the sequence was: EHLO STARTTLS EHLO (this time over the encrypted connection) Regards, Dianne.