Milter-greylist

Hi,

On 2016-09-06 20:41, Mauricio Teixeira mauricio.teixeira@... 
[milter-greylist] wrote:
>>>> # Greylisting Hosts Without Reverse DNS
>>>> racl greylist domain
>>>> /^\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\]$/ delay 1h
>> 
>> In my rulesets this adds a big score malus to delay longer in
>> greylists, and by the time this mail might be accepted sender may be
>> already in DNSBL.
> 
> I find it interesting that this topic just happened while I was
> scratching my head on a similar situation.
> 
> I've seen cases where the reverse does not match the forward, and
> milter-greylist is filtering them anyway. Example:
> 
> milter-reject: RCPT from unknown[203.235.210.192]: 451 4.7.1
> Greylisting in action, please come back in 00:13:18; bad reverse DNS;
> from=<blah@...> to=<blah@...> proto=ESMTP
> helo=<mymail.skcc.com [1]>
> 
> This is my rule:
> racl greylist domain
> /^\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\]$/ delay 120m msg
> "Greylisting in action, please come back in %R; bad reverse DNS"
> 
> 203.235.210.192 resolves to mymail.skcc.com [1]
> 
> but
> mymail.skcc.com [1] resolves to 203.235.210.190
> 
> So it seems like milter-greylist is getting confused, and thinks the
> fact that the reverse does not match the forward means there is no
> reverse.
> 
> How can I tell milter-greylist to just accept those cases when there
> is a reverse, even if it doesn't match the forward?

Am Dienstag, den 06.09.2016, 15:41 -0300 schrieb Mauricio Teixeira
mauricio.teixeira@... [milter-greylist]:
> 
> How can I tell milter-greylist to just accept those cases when there
> is a reverse, even if it doesn't match the forward?


I'm not sure if there is an RFC, which says forward DNS and rDNS must
match, but it's common practise for a well maintained sending host that
a lookup should be forward confirmed in result. If not you might tagged
as spam. Milter-greylist's result for your example IP 203.235.210.192 is
right to my mind, because 203.235.210.192 -> mymail.skcc.com ->
203.235.210.190 which doesn't match, even though there is a rDNS.

Ciao!