> On Sep 11, 2019, at 6:15 PM, Bill Cole
> <[email protected]> wrote:
>
> On 11 Sep 2019, at 17:05, J Doe wrote:
>
>> I glanced briefly to see if there were any other ways to restrict this but
>> none seemed evident to me.
>
>> Is there a way to achieve this ?
>
> As Viktor noted: a pcre check_helo_access map is useful.
>
> I have such a map with a few dozen lines of patterns that only ever match
> spam sources or are logically bogus (e.g. hostname.local) plus a handful of
> exemptions for non-spam sources who are easier to whitelist than educate. It
> catches rather less than it did before postscreen but it's still doing a
> substantial bit of cheap spam blocking.
>
>> Alternatively, should I not be attempting to do this because legitimate
>> server’s sometimes EHLO address literals ?
>
> As long as you have any initial submission segregated to ports 465 or 587,
> you shouldn't see any port 25 traffic EHLOing with address literals. It is
> formally allowable (just as it is formally allowable to EHLO as
> 'localhost.localdomain') but no legitimate mail server speaking to the world
> at large should ever be doing that.
Hi Bill,
In regards to the map with a few dozen patterns that only ever match spam
sources . . . would you be able to share that with me ?
Ok, good - I do separate out e-mail to submission, so I should be ok.
Thanks,
- J
