Re: Problem with whitelist_from_rcvd and forged reverse lookup

On Thu, 30 Jul 2009, Benny Pedersen wrote:

> On Thu, July 30, 2009 17:41, Sebastian Wiesinger wrote:
> > * Benny Pedersen <me@xxxxxxxx> [2009-07-30 17:37]:
> > > On Thu, July 30, 2009 17:17, Sebastian Wiesinger wrote:
> > > > > > the attached mail is whitelisted because 220.231.127.15 resolves to
> > > > > > localhost.  Am I doing something wrong or is this a bug?
> > >
> > > non working dns is not a spamassassin bug
> >
> > [sebastian@alita:~]$ host 220.231.127.15
> > 15.127.231.220.in-addr.arpa domain name pointer localhost.
>
> this is your dns error, it does not make sense

You are correct, but the problem is not in Sebastian's DNS - it is in the 
rDNS of the IP that contacted his MTA.

> > [sebastian@alita:~]$ host localhost
> > localhost has address 127.0.0.1
>
> this is ok, but the other above is not, not even for splitted dns view
>
> > It seems my DNS is working just fine. I think spamassassin should
> > detect this.
>
> detect what ?

Detect a last-untrusted with rDNS "localhost" and an IP address not in 
127/8

While not necessarily a spam sign, it's sure not kosher.

--
 John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
 jhardin@xxxxxxxxxx    FALaholic #11174     pgpk -a jhardin@xxxxxxxxxx
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  Activist: Someone who gets involved.
  Unregistered Lobbyist: Someone who gets involved with something
    the MSM doesn't approve of.                           -- WizardPC
-----------------------------------------------------------------------
 6 days until the 274th anniversary of John Peter Zenger's acquittal