Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Helo domain
  FAQ FAQ  Forum Search   Register Register  Login Login

Helo domain

 Post Reply Post Reply
Author
jerbo128 View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 March 2006
Status: Offline
Points: 178
Post Options Post Options   Thanks (0) Thanks(0)   Quote jerbo128 Quote  Post ReplyReply Direct Link To This Post Topic: Helo domain
    Posted: 26 August 2007 at 12:13am
I am getting a lot of emails through such as this:
X-SF-RX-Return-Path: <Hancock3Elder@qwerk.com>
X-SF-HELO-Domain: 5953C9C8
 
Does SF check the helo domain to be sure it is valid with MX / DNS lookup?  or are those checks only done on the return path?
 
Anyone have idea's for dealing with these?
 
jerbo128
Back to Top
sgeorge View Drop Down
Senior Member
Senior Member


Joined: 23 August 2005
Status: Offline
Points: 178
Post Options Post Options   Thanks (0) Thanks(0)   Quote sgeorge Quote  Post ReplyReply Direct Link To This Post Posted: 26 August 2007 at 2:22pm
Hmm, here's an option.  You can decide whether it would be worth it for you.  You can enable keyword filtering to scan all mail headers of the message using this option in SpamFilter.ini:
ScanAllHeaders=1
However, you may want to make sure that any existing keywords would not accidentally block "good" mail headers.

After your keyword filter is scanning all headers, you may be able to block odd helo domains using this RegEx keyword (but see warning below)
((?i)x-sf-helo-domain: [^.]+$)

A couple reasons to be careful with the keyword above...
  • I didn't test it.  I probably should have, but I'm in a rush today.
  • It's a very loose keyword - it will block any declared helo domain that does not have a dot "." (or full stop) in it.
  • In my experience some good (but lazy) mail senders do not send valid statements in their helo commands.  You will have to monitor your blocked mail, and make adjustments to the keyword to accommodate good servers with weird HELOs.
Good luck!

Stephen
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 26 August 2007 at 11:40pm
jerbo128,

SpamFilter will only perform limited checks on the HELO domain string provided when performing the SPF filter tests. In no other case is that value being used.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.078 seconds.