You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by Justin Mason <jm...@jmason.org> on 2004/02/17 20:17:00 UTC

Re: RCVD_NUMERIC_HELO

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Bob Menschel writes:
>Question concerning RCVD_NUMERIC_HELO
>
>The rule in the distribution rule set is:
>header RCVD_NUMERIC_HELO        Received =~ /helo[= ]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/i
>describe RCVD_NUMERIC_HELO      Received: contains a numeric HELO
>
>I've recently added the following rule to my personal rule set:
>header    RM_hr_HeloIP           Received =~ /helo=\[(?:\d{1,3}\.){3}\d{1,3}\]/
>describe  RM_hr_HeloIP           Spam passed through apparent spammer relay
>score     RM_hr_HeloIP           0.500  # 
>
>These are identical, except that mine includes square brackets around
>an IP address, and the distribution rule does not.
>
>Is there a reason the square brackets were left out of the
>distribution rule set?

Hi Bob --

yes, there is -- using 

	HELO 192.111.222.111

is illegal according to RFC821,

	HELO [192.111.222.111]

is legal.

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFAMmisQTcbUG5Y7woRAsw2AJ94RLB14+fZhJVi7M7SdMKRYG2E0ACfaHyy
y9fGQCRM3uBeRZnn0jGgFvc=
=hf+E
-----END PGP SIGNATURE-----