Interesting new dns failures

Mon May 21 20:03:17 UTC 2007

On Mon, 21 May 2007 11:54:36 PDT, Roger Marquis said:

> Are there sites that accept mail from domains without a valid MX/A
> record?

Depends what you call "valid".  A lot of sites get *real* confused when they
find out that the MX for foo.com is where foo.com's *inbound* mail servers
live, and that their *outward* facing mail servers are someplace totally
different (yes, there's *still* places that get this wrong - obviously,
not being able to talk to any of the 800-pound gorillas or even the 200-pound
dachsunds out there doesn't cause the sites to acquire kloo).

Then there's all the "valid" issues caused by "domain on MAIL FROM doesn't
match the EHLO and/or PTR lookups" that SPF and similar schemes haven't
succeeded in curing...

But in general, if a non-null MAIL FROM: arrives, and the purported domain
comes up NXDOMAIN or similar *totally* unreachable (as opposed to just hinky),
you're totally justified in either 4xx or 5xx'ing the sucker, because if you
250 it and then have to generate a bounce, you're left holding the bag.  But
again, just because it's a bad idea doesn't mean there's probably lots of places
that still do it...

Or as a co-worker who lurks here said the other day:

"212.150.245.56 resolves to 212.150.245.56.245.150.212.in-addr.arpa
And they want to know why we block it."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20070521/01649688/attachment.sig>