On 3/9/2005 4:01 PM, Justin Mason wrote: >>SA 3.0.2 currently performs a handful of tests against HELO greetings that >>contain an IP address. These tests don't currently fire when an "address >>literal" is used in the HELO greeting, but they should. > > actually, that's deliberate -- compare the frequencies of an RFC-2821 > address literal, vs. a raw address, and you'll notice that the latter > is much more prevalent in spam.
That's true, but the rules that compare for addresses should still check the address in literals. >>I think the four affected rules are RCVD_HELO_IP_MISMATCH, >>RCVD_NUMERIC_HELO, RCVD_ILLEGAL_IP, RCVD_BY_IP if the addr doesn't check out... -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
