Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 6 Mar 2017 17:15:22 +0000
From:      Matthew Seaman <matthew@FreeBSD.org>
To:        freebsd-questions@freebsd.org
Subject:   Re: Off topic: smtp HELO question
Message-ID:  <1350d47b-5723-5171-3cd9-27e9b02aeb8b@FreeBSD.org>
In-Reply-To: <58BD94BD.9020405@sneakertech.com>
References:  <58BD94BD.9020405@sneakertech.com>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--NPCiBVPdQnD7AsinKwjVcr9WAqX8r3sBl
Content-Type: multipart/mixed; boundary="pUfq80rc9GhU4svVxRvQIm4WBtmtRRAse";
 protected-headers="v1"
From: Matthew Seaman <matthew@FreeBSD.org>
To: freebsd-questions@freebsd.org
Message-ID: <1350d47b-5723-5171-3cd9-27e9b02aeb8b@FreeBSD.org>
Subject: Re: Off topic: smtp HELO question
References: <58BD94BD.9020405@sneakertech.com>
In-Reply-To: <58BD94BD.9020405@sneakertech.com>

--pUfq80rc9GhU4svVxRvQIm4WBtmtRRAse
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

On 2017/03/06 16:56, Quartz wrote:
> By default, if you're behind a NAT, Thunderbird sends your local IP
> address as part of the 'hello' when connecting to a mail server, which
> then gets stamped into the header info for all to see as the email is
> sent down the chain.
>=20
> I'm trying to debug some email issues, and I suspect that this initial
> header might be part of my problems. I can configure Thunderbird to sen=
d
> an arbitrary string instead of a NAT IP via the
> mail.smtpserver.smtp*.hello_argument variable, but I'm not 100% sure
> what I can legitimately put here without getting my emails marked as
> spam. Does this field have to match the reverse-lookup up of the
> world-routable external IP that you send the email through, or can it b=
e
> any arbitrary string that matches a domain name pattern? Can anyone
> point me to a resource that explains this in depth?

The HELO or EHLO name supplied by the sending side should match what is
returned by a reverse lookup on the IP the receiving side sees the
traffic coming from.

So if your NAT transforms internal addresses to W.X.Y.Z and a reverse
lookup 'host W.X.Y.Z' returns 'foo.example.com' then you should
configure your mail client to EHLO as 'foo.example.com'

Note however that this is not an absolute requirement -- whether a
receiving MTA checks this sort of thing is down to the individual
administrator.  Most do, as it is a very cheap way to dump various types
of spam.

In particular, for the specific case of a client program like
Thunderbird talking SMTP to a server via the Submission port (587) it is
rare to find this sort of check.  For mail submission you generally
identify yourself by logging into the server after switching your
connection to TLS, which provides better proof of identity than forward
and reverse DNS checks.  The HELO/EHLO name thing is much more important
for MTA to MTA transmission via port 25.

	Cheers,

	Matthew



--pUfq80rc9GhU4svVxRvQIm4WBtmtRRAse--

--NPCiBVPdQnD7AsinKwjVcr9WAqX8r3sBl
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQJ8BAEBCgBmBQJYvZkxXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxOUYxNTRFQ0JGMTEyRTUwNTQ0RTNGMzAw
MDUxM0YxMEUwQTlFNEU3AAoJEABRPxDgqeTnXmcP/jvWmNFfTnOrCa2YZLNkLTHh
AP3IKKDprxXjrduz6Qt58BuiUiiZJztgtkVt5Zh41pA1ZgvkwQZEzLhOnJzpCUg5
t4h0o9/ejAdvBqCvDSK7LijMfS1wM3irhCT4dieEmFqecQgXSlvgjvUHsTX6P9nE
HLLJSRupM1bVZsRk33QuSL+3FjoyuiDbQHeJ5D5wEf1MCxdshfJEkHEgyir3sdlE
a7quYPzzYM7dmLlQ90EVcmgPIISUIRGL8ooFPFRI3hz49S4ScxW/2KZ7ImPB4+II
oIFKGjKrimBFGtxE4KYQ2YrjaOtr40pbo2Ru16rrEdBmvlVAOfFkCdtPDW9zZOOM
dEmWuatUD622FFtjhmFPt8srNA6qLIw1ZHrSi7RfWsLb3LH0uJpxZ8FsN/btOnL1
QC7aJdouAZDLo0CvkxguLRZ3v/IqJilrV7ptrUxK9NFKm4ev2c6oCTbEsPVnpNJx
lRQn9WYvki4MzDOgIt1GPBWwaqrFGjMDyC5Z80FvdimuflbPvbAsVvIqMUdn1sMh
MomRFOKwQTUpd8xao+7aTQN0HUS0qF4RTfDINUtKn0Dh/HXtMXXAP2bOL/P0WyA8
VN8iJNknECr6V4uHXQThNE2xf/wwDG0M2J3e7GjwRmLQi9NWAiHEGVWqiiFlneaG
9hxISBNM8qwqdoHxZ5Ru
=Acjx
-----END PGP SIGNATURE-----

--NPCiBVPdQnD7AsinKwjVcr9WAqX8r3sBl--



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?1350d47b-5723-5171-3cd9-27e9b02aeb8b>