From mboxrd@z Thu Jan  1 00:00:00 1970
Message-ID: <c1770ffea935d0e02e87e1d4d3a4cb54@quanstro.net>
From: erik quanstrom <quanstro@quanstro.net>
Date: Thu,  8 Jan 2009 18:43:32 -0500
To: 9fans@9fans.net
In-Reply-To: <F5A72216-0332-4D18-B83A-210E111676CE@ar.aichi-u.ac.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Subject: Re: [9fans] dealing with spam
Topicbox-Message-UUID: 7dc9969a-ead4-11e9-9d60-3106f5b1d025

> I am using this one: http://plan9.aichi-u.ac.jp/spamfilter/
> which is working quite comfortably for me.

i found this bit interesting:

	Some mail server's IPs are a little different from the IPs obtained
	using DNS query. For example, I observed

 	   Received: from coraid.com ([12.51.113.4]) by ar; Sat Nov 22 07:55:40 JST 2008

	However

	ar% ndb/dnsquery
	> coraid.com
	coraid.com ip   12.51.113.3

/lib/rfc/rfc2821 §3.6 says that EHLO domains must be resolvable.
i don't think it says that the EHLO domain must match
the reverse lookup of the connecting machine's ip.  in fact
the examples given seem to use a domain where one would
expect a host within the domain.

on the other hand, from this perspective saying "coraid.com"
when in fact you are baron.coraid.com is a bit fishy.

is there some concrete reason this is wrong or is it really
a grey area?

- erik