Bug 5972

Summary: FM_FAKE_HELO_VERIZON fires if MTA does do rdns lookup
Product: Spamassassin Reporter: mouss <mouss>
Component: RulesAssignee: SpamAssassin Developer Mailing List <dev>
Status: RESOLVED WONTFIX    
Severity: normal CC: apache
Priority: P5    
Version: 3.2.5   
Target Milestone: Undefined   
Hardware: Other   
OS: All   
Whiteboard:

Description mouss 2008-09-14 05:35:46 UTC 
FM_FAKE_HELO_VERIZON checks whether the helo ends in verizon.net while the rdns does not. However, if the MTA does not lookup the rdns, this rule will fire. 

Here is an example (Mail from Matt Kettler relayed via the list)

Received: from [206.46.173.5] (HELO vms173005pub.verizon.net) (206.46.173.5)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 11 Sep 2008 13:09:28 +0000


I guess the same problem will happen with hotmail. 

here is a possible fix

# check that the rdns field contains a valid domain by looking at the last char.
header __FHOST_RDNS  X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=[^ ]*[a-z] /i
# if Received.pm is patched to ignore obviously invalid rdns, we could simply do: 
#header __FHOST_RDNS  X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns= /i

meta FM_FAKE_HELO_VERIZON (__FHELO_VERIZON && !__FHOST_VERIZON && __FHOST_RDNS)
meta FM_FAKE_HELO_HOTMAIL (__HOTMAILCOM && !__HOST_HOTMAIL && __FHOST_RDNS)
Comment 1 Henrik Krohns 2019-06-27 14:38:32 UTC 
Closing old stale bugs. FM_FAKE_HELO_VERIZON does not exist anymore.