'k, I'm using Postfix here ... there are a whack of 'anti-*' checks that I
*can* enable that deal with reverse DNS and a bunch of other things, but I
found when I tried that ages back that there was alot of mail being
rejected from legit sources :(
On Wed, 27 Aug 2003, Richard Welty wrote:
> On Wed, 27 Aug 2003 19:55:36 -0300 (ADT) "Marc G. Fournier" <scrappy@hub.org> wrote:
>
> >
> > I've just moved some anti-virus/anti-spam checks a bit closer to the
> > source, and am now rejecting the following before it even gets to the
> > anti-virus checking, and/or majordomo:
>
> i don't know what MTA you're using, but if it supports syntax checks on the
> HELO/EHLO strings, you might want to look at blocking strings that don't
> include a "." in the middle. the RFCs require this to be either an FQDN or
> a literal IP, and most of the virus stuff is coming from M$ hosts that use
> the BIOS name (not a FQDN) in their HELO strings.
>
> i found i could reject the bulk of the Sobig stuff after receiving a HELO.
>
> richard
> --
> Richard Welty rwelty@averillpark.net
> Averill Park Networking 518-573-7592
> Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security
>
>
>