Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

CentOS 5.x | SendMail 8

Can I get clarification on what exactly the warning "IP may be forged" means and what conditions cause it? I recently configured SendMail to relay email from my exchange server and it's showing that warning in the logs. The messages get delivered fine but I don't like the warnings.

I originally thought that there was an inconsistency between the servername used in the EHLO statement from Exchange and the respective PTR record for the source IP for Exchange. But upon examining a packet capture, I see exchange using "EHLO" and that the source IP has a PTR of "". Maybe sendmail doesn't like that the greeting only has the domain?


share|improve this question
Possible duplicate: – Justin Scott Jun 7 '10 at 21:20
@Justin Scott - Thanks for the prompt feedback but I think this issue is slightly different in that I don't have a respective entry for the greeting hostname in the /etc/hosts file. I'd also like to understand what is being checked for here. – Mike B Jun 8 '10 at 22:18

When sending a HELO string to the SMTP server, HELO is followed by either a literal or a FQDN. If it is followed by a FQDN, then the A and PTR records must match. If they do not, then a warning is returned. In your case the PTR points to but what about the A record?

See also RFC5321 Section 4.1.4

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.