[Raw Msg Headers][Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: SMTP policy and DNS temporary unavailability



Hello.

Just a thoughts about proper (for me, of course :-) smtp-policy... 
and maybe, somebody will help me to implement it into configs. 
smtp-policy.src _logic_ (rules interaction) is still not transparent 
for me.

I just follow steps mentioned in smtp-policy.src.

1. Connection establishment:  (IP address tested)

Just determine "MyClient" or "Non-MyClient". No immediate actions. 
Using RBL, etc. is too unpredictable in case of my (poor) 
connectivity.

2. HELO/EHLO parameter string:

If MyClient: No any tests. MS-Win home computers _may_ say "HELO 
Default".

If Non-MyClient: HELO must be an resolvable (either A or MX) FQDN. 
NB: reverse DNS comparison with #1 should not be done! Multihomed 
hosts and NAT-firewalled senders may exist, that's OK. But some ugly
spammers working from dial-up MS-Win boxes will be rejected with 
their "HELO gennady".

3. MAIL FROM address:

Both MyClient and Non-MyClient: FQDN address must be resolvable to 
either A or MX. Nobody (including clients) may send mail from 
definitely false origin. Surely, existing origin can be false 
too, and UUCP is rulezzz forewer :-). And surely, domain expansion 
should not be applied: MAIL FROM:<dean@physics> was rejected by our 
Technical Univercity relay until these folks configure their 
departament mailserver properly. And that's right.

4. RCPT TO address:

If MyClient: accept if address is syntaxically correct and can be 
tried for resolving in Router. No any immediate DNS checks should be 
done. We must finish dial-up session as fast as possible.

If Non-Myclient: accept if RELAYTARGET. Generally, it does not 
require DNS lookups - just own Zmailer database.

5. Resume.

For MyClients (determined in #1), no external DNS lookups should 
be done at all while SMTP session! Mail must be quickly accepted for 
relaying even if our external connectivity is completely broken now.
Actually, in #3 DNS lookup is done; but most of MyClients use 
local domains which are reliably resolved inside of the site. Those 
who use FROM: @hotmail.com, @mail.ru, etc... operate at their own 
risk. That's life.

For Non-MyClients we may use DNS as heavily as we want. First, if 
somebody reached us from outside by SMTP, than connectivity is 
present. Second, Non-MyCliens _must_ be servers, not dial-up 
machines; so, big pauses and 4xx temporary rejections are allowed.

I believe, this model is quite typical for a server being both 
inbound and outbound relay for dial-up/SMTP users. And the respective 
Zmailer ruleset may be useful for many people. I ask all of you to 
help to make it...

Regards,
Alexey.