Post B5L674xldDfcrwJI1I by mirabilos@toot.mirbsd.org
 (DIR) More posts by mirabilos@toot.mirbsd.org
 (DIR) Post #B5L2jFGjMaWc1H7jKy by hyc@mastodon.social
       0 likes, 0 repeats
       
       @dalias if you're really self-hosting your email you should have an actual domain name of your own though, and it should resolve both forward and backward.
       
 (DIR) Post #B5L2jFS4gPbCaSQn1E by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @hyc @dalias yes, but it doesn’t have to go in a circle.mx.mydomain → 2001:dba:…:1 → somehost.provider → 2001:dba:…:1 is good enough for eMail, as that’s within the reach of most, but not in the cheap cloud crap spammers seem to like.
       
 (DIR) Post #B5L674W7I1YJUBNCvA by AnachronistJohn@zia.io
       0 likes, 0 repeats
       
       @dalias Ages ago, I twisted my brain enough to learn Sendmail rules and came up with two HELO / EHLO checks: one which requires that the HELO / EHLO name resolves to the connecting IP(v6), and that the PTR for that address also resolves to the same address, and one that’s not as aggressive and just makes sure that the HELO / EHLO name resolves in DNS.Checking that the PTR name resolves to the same address as the PTR is beyond Microsoft. I think they’re not allowed to have O’Reilly animal books. They really take “not invented here” seriously, and considering they haven’t invented shit, nothing of theirs works properly.LOCAL_RULESETSScheck_mailKcheckdns dns -R AKcheckv6 dns -R AAAAKcheckptr dns -R PTRFH /etc/mail/access# require_dns.m4, 9-November-2003, John Klos (jklos@netbsd.org)#   Updated 6-January-2007#   Checks that HELO IP literal matches connecting machine, and#   checks that HELO domain name resolves (but not necessarily back#   to the connecting server), and that it isn't our name.# This HELO checking is what should be done, anyway; syntactically#   invalid HELOs are allowed to be rejected. Checking whether a #   HELO hostname resolves is my lazy way of checking the syntax.# localhost (real address, not HELO localhost) is always Ok.R$*         $: $&{client_addr}R127.0.0.1      $@RIPv6:::1       $@RIPv6:0:0:0:0:0:0:0:1   $@# Skip checking if connection is authenticatedR$*         $: <$&{auth_type}>R<PLAIN>        $@# Reject addresses with no / broken reverse DNSR$*         $: < $&{client_resolve} >R<TEMP>         $#TEMP $@ 4.4.0 $: "450 Relaying temporarily denied. Cannot resolve PTR record for " $&{client_addr}R<FORGED>       $#error $@ 5.7.1 $: "550 Relaying denied. PTR likely forged " $&{client_name}R<FAIL>         $#error $@ 5.7.1 $: "550 Relaying denied. PTR lookup failed " $&{client_name}# Reject our own names. Anything that's in /etc/mail/access or #   /etc/mail/local-host-names should not match any HELO name.R$*         $: $&sRlocalhost      $#error $@ 5.1.8 $: "550 Access denied. You are not obviously not localhost."R$=w            $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."R$=H            $#error $@ 5.1.8 $: "550 Access denied (access file). You are not "$&s"."# Reject common domain names which all use proper HELO strings.Ryahoo.com      $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."Rjuno.com       $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."Rgoogle.com     $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."Routlook.com        $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."Rhotmail.com        $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."Rmsn.com        $#error $@ 5.1.8 $: "550 Access denied. You are not "$&s"."# This test checks if the HELO string either matches or is the last part of #   the PTR record for services such as Hotmail and Gmail.R$*         $: <$&{client_name}> <$&{client_resolve}>R<$*$&s> <OK>       $@# Skip checking if connection is authenticatedR$*         $: <$&{auth_type}>R<PLAIN>        $@# These rules assume that all will be OK if:#   HELO [IP address] matches [{client_addr}] or#   HELO [IPv6:IPv6 address] matches [{client_addr}]#   Or, if neither of the above, that the HELO string must be a FQDN (primary#   host name) as per the RFCs and therefore should resolve. Non-matching#   [IP address] or [IPv6:IPv6 address] do not resolve as FQDN and fail below.R$*         $: $&sR [$&{client_addr}] $@# Stick the connecting IP address into the workspace; if it's an IPv6 address,#   replace it with the IPv6 address of the AAAA HELO lookup. If it matches#   the connecting IP, it's Ok.R$*         $: $&{client_addr}RIPv6:$+        $: <$( checkv6 $&s $: FAIL $)>V6R<$&{client_addr}>V6    $@# Stick the IP address of the A HELO lookup into the workspace. Fail#   if the lookup fails.R$*         $: <$( checkdns $&s $: FAIL $)>V4R<FAIL>V4       $#error $@ 4.1.8 $: "550 Access denied. HELO does not resolve. (HELO " $&s ")"R<$&{client_addr}>V4    $@
       
 (DIR) Post #B5L674xldDfcrwJI1I by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @dalias @AnachronistJohn bookmarked!While I’m no fan of HELO/EHLO restrictions, the going-away of the public IP blacklist whose name I forgot exposed me to much more spam again… will see when I will have time to look at this.