On 11 Sep 2019, at 17:05, J Doe wrote:
I glanced briefly to see if there were any other ways to restrict this
but none seemed evident to me.
Is there a way to achieve this ?
As Viktor noted: a pcre check_helo_access map is useful.
I have such a map with a few dozen lines of patterns that only ever
match spam sources or are logically bogus (e.g. hostname.local) plus a
handful of exemptions for non-spam sources who are easier to whitelist
than educate. It catches rather less than it did before postscreen but
it's still doing a substantial bit of cheap spam blocking.
Alternatively, should I not be attempting to do this because
legitimate server’s sometimes EHLO address literals ?
As long as you have any initial submission segregated to ports 465 or
587, you shouldn't see any port 25 traffic EHLOing with address
literals. It is formally allowable (just as it is formally allowable to
EHLO as 'localhost.localdomain') but no legitimate mail server speaking
to the world at large should ever be doing that.
--
Bill Cole
[email protected] or [email protected]
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
