Facebook
Twitter
Hi,
the standard greylisting filter contains afaik the following blacklist to catch dynamic IPs:
Black domains patterns list:
*[0-9][0-9]-[0-9][0-9]-[0-9][0-9]*
*[0-9][0-9].[0-9][0-9].[0-9][0-9]*
*[0-9][0-9][0-9]-[0-9][0-9][0-9]-[0-9][0-9][0-9]*
*[0-9][0-9][0-9].[0-9][0-9][0-9].[0-9[0-9]][0-9]*
dsl|broadband|hsd
dynamic|static|ppp|dyn-ip|dial-up
If I have observed it correctly, these patterns are matched against the clients HELO/EHLO hostname. However, I think this should not be done this way, since RFC 2821 states that an SMTP server must not reject messages if they do not match the actual reverse hostname. I must admit that matching the hostname against these regexes is not a violation of the RFC per se, but I have seen more than one Mailserver, whose hostname is set by the VPS (and matches the above regex, since it contains the servers IP). The server than uses this name in the HELO and the message submission fails.
I am not advocating for not using this blacklist, but imho it should be matched against the rDNS hostname of the IP which connects (that might already eliminate a part of the dynamic IPs, if they have no rDNS at all).
Cheers,
Dan
the standard greylisting filter contains afaik the following blacklist to catch dynamic IPs:
Black domains patterns list:
*[0-9][0-9]-[0-9][0-9]-[0-9][0-9]*
*[0-9][0-9].[0-9][0-9].[0-9][0-9]*
*[0-9][0-9][0-9]-[0-9][0-9][0-9]-[0-9][0-9][0-9]*
*[0-9][0-9][0-9].[0-9][0-9][0-9].[0-9[0-9]][0-9]*
dsl|broadband|hsd
dynamic|static|ppp|dyn-ip|dial-up
If I have observed it correctly, these patterns are matched against the clients HELO/EHLO hostname. However, I think this should not be done this way, since RFC 2821 states that an SMTP server must not reject messages if they do not match the actual reverse hostname. I must admit that matching the hostname against these regexes is not a violation of the RFC per se, but I have seen more than one Mailserver, whose hostname is set by the VPS (and matches the above regex, since it contains the servers IP). The server than uses this name in the HELO and the message submission fails.
I am not advocating for not using this blacklist, but imho it should be matched against the rDNS hostname of the IP which connects (that might already eliminate a part of the dynamic IPs, if they have no rDNS at all).
Cheers,
Dan
