Print Page | Close Window

Helo domain

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6216
Printed Date: 02 June 2025 at 9:12pm


Topic: Helo domain
Posted By: jerbo128
Subject: Helo domain
Date Posted: 26 August 2007 at 12:13am
I am getting a lot of emails through such as this:
X-SF-RX-Return-Path: http://mail.flubix.com/Xa2ce9b9a9fcbcfcc9d926a02aaab/newmsg.cgi?mbx=Main&to=Hancock3Elder@qwerk.com - <Hancock3Elder@qwerk.com>
X-SF-HELO-Domain: 5953C9C8
 
Does SF check the helo domain to be sure it is valid with MX / DNS lookup?  or are those checks only done on the return path?
 
Anyone have idea's for dealing with these?
 
jerbo128


Replies:
Posted By: sgeorge
Date Posted: 26 August 2007 at 2:22pm
Hmm, here's an option.  You can decide whether it would be worth it for you.  You can enable keyword filtering to scan all mail headers of the message using this option in SpamFilter.ini:
ScanAllHeaders=1
However, you may want to make sure that any existing keywords would not accidentally block "good" mail headers.

After your keyword filter is scanning all headers, you may be able to block odd helo domains using this RegEx keyword (but see warning below)
((?i)x-sf-helo-domain: [^.]+$)

A couple reasons to be careful with the keyword above...
  • I didn't test it.  I probably should have, but I'm in a rush today.
  • It's a very loose keyword - it will block any declared helo domain that does not have a dot "." (or full stop) in it.
  • In my experience some good (but lazy) mail senders do not send valid statements in their helo commands.  You will have to monitor your blocked mail, and make adjustments to the keyword to accommodate good servers with weird HELOs.
Good luck!

Stephen

Posted By: LogSat
Date Posted: 26 August 2007 at 11:40pm
jerbo128,

SpamFilter will only perform limited checks on the HELO domain string provided when performing the SPF filter tests. In no other case is that value being used.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window