Subject: [Emailcore] Ticket #19: G.7.6. Requirements for domain name and/or IP address in EHLO

From: Todd Herr <[email-masked]>
Date: Fri, 9 Jul 2021 15:24:47 -0400

Greetings.

I would like to begin a discussion on ticket #19 -
https://trac.ietf.org/trac/emailcore/ticket/19 - as a long belated follow
on to discussion that was had during IETF 110.

Section 4.1.4 of draft-ietf-emailcore-5321bis includes this paragraph:

   An SMTP server MAY verify that the domain name argument in the EHLO
   command actually corresponds to the IP address of the client.
   [[CREF13: [5321bis] [[Note in draft -- proposed change to "An SMTP
   server MAY verify that the domain name argument in the EHLO command
   has an address record matching the IP address of the client." --David
   MacQuigg, [email-masked], Friday, 20090130 0637 -0700]]]]
   However, if the verification fails, the server MUST NOT refuse to
   accept a message on that basis.  Information captured in the
   verification attempt is for logging and tracing purposes.  Note that
   this prohibition applies to the matching of the parameter to its IP
   address only; see Section 7.9 for a more extensive discussion of
   rejecting incoming connections or mail messages.

Discussion at IETF 110 (https://codimd.ietf.org/notes-ietf-110-emailcore)
landed on adding text to the Applicability Statement regarding how mail
might be rejected if EHLO hostname doesn't resolve in DNS to IP address of
SMTP client.

I propose the following as a strawman...

Change the above paragraph to read as follows:

   An SMTP server MAY verify that the domain name argument in the EHLO
   command has an address record matching the IP address of the client.

And include the following text in the Applicability Statement:

   If the domain name argument in the EHLO command does not have an address
   record in the DNS that matches the IP address of the client, the SMTP
   server may refuse any mail from the client as part of established
anti-abuse
   practice. Operational experience has demonstrated that the lack of a
matching
   address record for the the domain name argument is at best an indication
of
   a poorly-configured MTA, and at worst that of an abusive host.
Thoughts?
-- 

*Todd Herr* | Technical Director, Standards and Ecosystem
*e:* [email-masked]
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.

---

From: Michael Peddemors <[email-masked]>
Date: Fri, 9 Jul 2021 12:31:32 -0700

On 2021-07-09 12:24 p.m., Todd Herr wrote:
>     address record for the the domain name argument is at best an 
> indication of

Disagree, the EHLO MAY be an internal identifier, and while operators 
may choose many forms of validation of EHLO, it should NOT be confused 
with information related to the IP Address, whereas PTR records are 
related to the IP Address.  They serve different purposes, and should 
not be cross correlated.  And while anyone is able to reject any 
connection, for any reason they see fit, this should NOT be part of the 
RFC's.

Not to mention, we still see far too many valid uses of EHLO that do not 
conform to that.  Eg, internal delivery farms, where the administrators 
find that using an internal naming convention, unrelated to their public 
naming conventions

-- 
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.

---

From: "John Levine" <[email-masked]>
Date: 9 Jul 2021 23:59:28 -0400

>conform to that.

On the public Internet? Really? I agree you see all sorts of crud in
submission and within private networks, but in SMTP relay to an MX, I
don't think I see any hosts that EHLO without a valid name, at least
not any from which I would want to receive mail.

R's,
John

---

From: Laura Atkins <[email-masked]>
Date: Sat, 10 Jul 2021 08:50:12 +0100

> On 9 Jul 2021, at 20:24, Todd Herr <todd.herr=[email-masked]> wrote:
> 
> Greetings.
> 
> I would like to begin a discussion on ticket #19 - https://trac.ietf.org/trac/emailcore/ticket/19 <https://trac.ietf.org/trac/emailcore/ticket/19> - as a long belated follow on to discussion that was had during IETF 110.
> 
>    MacQuigg, [email-masked] <mailto:[email-masked]>, Friday, 20090130 0637 -0700]]]]
> Discussion at IETF 110 (https://codimd.ietf.org/notes-ietf-110-emailcore <https://codimd.ietf.org/notes-ietf-110-emailcore>) landed on adding text to the Applicability Statement regarding how mail might be rejected if EHLO hostname doesn't resolve in DNS to IP address of SMTP client.
> 
>    server may refuse any mail from the client as part of established anti-abuse
>    practice. Operational experience has demonstrated that the lack of a matching
>    address record for the the domain name argument is at best an indication of

Bit rot happens and can affect EHLO values. In fact, the number of domains where the HELO doesn’t match the IP but does match a different IP in the same cluster is significant based on my investigations over the years. I’m never surprised when things don’t match. I might tone down the judgement a little bit. The lack of a matching address record isn’t “at best a poorly-configured MTA”. My experience suggests that it's more likely at this point in time that abusive hosts match - as they’re often programatically deployed and everything is set up to match.

“Operational experience tells us that some types of abusive hosts forge or otherwise fake a HELO value. SMTP operators may choose to block systems based on the EHLO value mismatch…” 

laura 

> -- 
> Todd Herr | Technical Director, Standards and Ecosystem
> e: [email-masked] <mailto:[email-masked]> 
> m: 703.220.4153
> 
> This email and all data transmitted with it contains confidential and/or proprietary information intended solely for the use of individual(s) authorized to receive it. If you are not an intended and authorized recipient you are hereby notified of any use, disclosure, copying or distribution of the information included in this transmission is prohibited and may be unlawful. Please immediately notify the sender by replying to this email and then delete it from your system.
> -- 
> Emailcore mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/emailcore

-- 
Having an Email Crisis?  We can help! 800 823-9674 

Laura Atkins
Word to the Wise
[email-masked]
(650) 437-0741		

Email Delivery Blog: https://wordtothewise.com/blog

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 13 Jul 2021 13:27:37 +0200

>     command has an address record matching the IP address of the client.

I'd make that even more abstract, for example:

     An SMTP server MAY verify the validity of the domain name argument in
     the EHLO command.

Domain name to IP, IP to PTR name, SPF, and more are different verification 
criteria, sometimes overlapping and sometimes not.

>   [snip text to be discussed at A/S time]

Best
Ale
--