[Greylist-users] HELO

[Alan Batie]

I've been getting a flood of porn ads leaking through even greylisting
lately.  They're using my address as both the to/from.  I can't have
spamassassing block that pattern because of mail from cron jobs, but
I notice that they're using my hostname on the Received headers too:

    From alan at agora.rdrop.com Sun Jul 20 23:18:39 2003
    Received: from agora.rdrop.com ([61.100.195.45])
	    by agora.rdrop.com (8.12.9/8.12.7) with ESMTP id h6L6IboT006963
	    for <alan at agora.rdrop.com>; Sun, 20 Jul 2003 23:18:38 -0700 (PDT)
	    (envelope-from alan at agora.rdrop.com)
    Message-Id: <200307210618.h6L6IboT006963 at agora.rdrop.com>
    Received: from MIRAE [61.100.195.45] by agora.rdrop.com with MailMXPro(2195.5674); 
	    Mon, 21 Jul 2003 15:19:56 -0600
    From: "jenny hewit" <alan at agora.rdrop.com>
    To: <alan at agora.rdrop.com>
    Subject: Girls On Webcams! (Adults Only)

I think for my hostname to appear on the Received header, it must be the
name they're using in the HELO, and I'm wondering if you can block a message
that says its from a localhostname that does not have an A or MX address
that matches?  Does a milter have access to the presented hostname?

-- 
Alan Batie                   ______    alan.batie.org                Me
alan at batie.org            \    /    www.qrd.org         The Triangle
PGPFP DE 3C 29 17 C0 49 7A    \  /     www.pgpi.com   The Weird Numbers
27 40 A5 3C 37 4A DA 52 B9     \/      spamassassin.taint.org  NO SPAM!

To announce that there must be no criticism of the President, or that we
are to stand by the President, right or wrong, is not only unpatriotic
and servile, but is morally treasonable to the American public.
-Theodore Roosevelt, 26th US President (1858-1919)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 305 bytes
Desc: not available
Url : http://lists.puremagic.com/pipermail/greylist-users/attachments/20030721/d4dcb45f/attachment.bin