On Mon, Jul 18, 2011 at 07:41:09AM -0500, Les Mikesell wrote: > On 7/18/11 5:43 AM, Stephen Harris wrote: > >>> RFC2821 says: > >>> - The domain name given in the EHLO command MUST BE either a primary > >>> host name (a domain name that resolves to an A RR) or, if the host > >>> has no name, an address literal as described in section 4.1.1.1. > >>> > >>> So, pretty much, HELO or EHLO greeting _must_ match to an IP. > >>> > >>> (RFC821 actually wanted the HELO to match the connecting host, but > >>> 2821 just says it must be an A record or an address literal). > Can you point me to the section? I don't see anything there about the hostname > having to match an interface address or being allowed to reject if it isn't - or > even any advice on how clustered hosts representing one mail domain should > represent themselves. I think you think I'm disagreeing with you; I'm not. I'm agreeing with you. The RFCs don't require the SMTP server to match the interface IP address. Note that RFC821 has been obsoleted and replaced with 2821. Anyone programming to 821 requirements is doing it wrong. In fact 2821 has been replaced with 5321 5321 says 2.3.5 [...] The domain name given in the EHLO command MUST be either a primary host name (a domain name that resolves to an address RR) or, if the host has no name, an address literal, as described in Section 4.1.3 and discussed further in the EHLO discussion of Section 4.1.4. I think that reference to 4.1.4 should really be 4.1.1.1... 4.1.1.1. Extended HELLO (EHLO) or HELLO (HELO) These commands are used to identify the SMTP client to the SMTP server. The argument clause contains the fully-qualified domain name of the SMTP client, if one is available. In situations in which the SMTP client system does not have a meaningful domain name (e.g., when its address is dynamically allocated and no reverse mapping record is available), the client SHOULD send an address literal (see Section 4.1.3). You only need to follow 5321 requirements which do _not_ require the host to identify it as matching the specific interface; it merely needs to identify as a valid A record (or address literal) for the client system. There's nothing to say that the client system need be listening to port 25 (or be open to port 25 connections; firewalls for example), so anyone performing HELO (or EHLO) address verification is pretty much limited to the 2.3.5 requirement; that the passed name is _a_ valid name. Which is, AFAIK, all postfix does. -- rgds Stephen _______________________________________________ CentOS mailing list CentOS@xxxxxxxxxx http://lists.centos.org/mailman/listinfo/centos