Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

CentOS 5.x | SendMail 8

Can I get clarification on what exactly the warning "IP may be forged" means and what conditions cause it? I recently configured SendMail to relay email from my exchange server and it's showing that warning in the logs. The messages get delivered fine but I don't like the warnings.

I originally thought that there was an inconsistency between the servername used in the EHLO statement from Exchange and the respective PTR record for the source IP for Exchange. But upon examining a packet capture, I see exchange using "EHLO domain.com" and that the source IP has a PTR of "domain.com". Maybe sendmail doesn't like that the greeting only has the domain?

-M

share|improve this question
    
Possible duplicate: serverfault.com/questions/111641/sendmail-ip-may-be-forged –  Justin Scott Jun 7 '10 at 21:20
    
@Justin Scott - Thanks for the prompt feedback but I think this issue is slightly different in that I don't have a respective entry for the greeting hostname in the /etc/hosts file. I'd also like to understand what is being checked for here. –  Mike B Jun 8 '10 at 22:18

1 Answer 1

When sending a HELO string to the SMTP server, HELO is followed by either a literal or a FQDN. If it is followed by a FQDN, then the A and PTR records must match. If they do not, then a warning is returned. In your case the PTR points to domain.com but what about the A record?

See also RFC5321 Section 4.1.4

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.