Subject: Re: [Emailcore] Ticket #2: Repeated Use of EHLO

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 11 Mar 2021 03:39:55 -0200

> On Oct 20, 2020, at 3:02 AM, John C Klensin <[email-masked]> wrote:
> 
> I can think of cases in which they might change and the change
> might be significant, but they are far-fetched enough that, if a
> rule were adopted that if as second EHLO is sent it must contain
> the same information would probably be harmless.

One can imagine cases for the HELO name to change for an MTA behind
a trusted proxy that serialises a sequence of incoming connections
from clients over a single connection to a backend MTA.  It might then
reissue EHLO to match the data sent by the external client.

(Of course such a proxy would have to be careful to not give clients
unfiltered access to the downstream SMTP channel).

In Postfix signal of the upstream client identity would typically
be done via XCLIENT or XFORWARD, but there could be other legitimate
reasons for a client or proxy to change the HELO name.

There does not seem to be much point to prohibit this, if anything,
the client is giving the server more information that can help
distinguish friend from foe.  The client could always reconnect
and switch identities, which would be more expensive.   Let it
send a new EHLO if it wants.

-- 
	Viktor.