Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured my postfix as follows:

smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unknown_helo_hostname

This is working well because most spambots don't seem to have correct reverse lookups. But every once in a while I run into mail I care about getting reject, because the mail source server admin doesn't care about configuring his server correctly.

For example here the server introduces itself as "" which has no DNS record and fails my basic check.

Jan  6 04:42:36 mail postfix/smtpd[660]: connect from[]
Jan  6 04:42:37 mail postfix/smtpd[660]: NOQUEUE: reject: RCPT from[]: 450 4.7.1 <>: Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo=<>

I have tried to contact the server admin several times, but there is no response. What is the optimal way to handle this from my side? Is adding these "special" hosts to mynetworks = my only option? Is perhaps my whole smtpd_helo_restrictions setup wrong in some significant way?

share|improve this question

As you noted, there is no forward DNS entry for the hostname given by the remote mail server.

$ host
Host not found: 3(NXDOMAIN)

This isn't a significant problem, as these often are internal hostnames with no meaning on the public Internet.

For a complete list of things I do check for, see this answer on spam prevention. On my public mail servers, I never use reject_unknown_helo_hostname even though it's listed as a recommendation there (another user added it).

share|improve this answer
I now noticed I might've built my question incorrectly. Notice that introduces itself to my mail server as 450 4.7.1 <>. That is the actual problem. There is no DNS record for it. – lkraav Jan 6 '13 at 19:36
Thanks for the spam-fight answer link, great material. No doubt I will need to upgrade my anti-spam setup, but there's no resource to embark upon it immediately. I'll leave this open until then. OTOH, I understand it's a lot of work to configure every little detail, but I think one's internal network names shouldn't really be able to get out and disturb the public network in this way. – lkraav Jan 7 '13 at 10:59

DO NOT use wholesale hostname rejection unless you plan to reject mail from most all automated systems out there. Yes, it's not entirely RFC-compliant, but no, they won't change it any time soon.

I generally recommend using

warn_if_reject reject_unknown_helo_hostname

instead; this will log RFC-ignorant EHLO but still let them through.

Especially sExchange machines are notorious for using only the ugly netbios hostname to EHLO.

share|improve this answer

What is the optimal way to handle this from my side? you have 2 ways

Is adding these "special" hosts to mynetworks = my only option? No, it does

Is perhaps my whole smtpd_helo_restrictions setup wrong in some significant way? no, it has a general restriction rules.

The easiest way. You can skip checks for these host

smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks, check_helo_access hash:/etc/postfix/helo_access, reject_unknown_helo_hostname

Add the following line to the file OK

and create the map file

# postmap /etc/postfix/helo_access
# service postfix restart

The hard way. You need to create your own restriction class

smtpd_restriction_classes = sender_white_list
sender_white_list = check_client_access hash:/etc/postfix/check_client_access, reject

smtpd_helo_restrictions =  permit_mynetworks, permit_sasl_authenticated, check_helo_access hash:/etc/postfix/check_helo_access

/etc/postfix/check_helo_access sender_white_list

/etc/postfix/check_client_access OK

With such configuration helo name "" would be permitted only from host ip

share|improve this answer

....Quick and simple: Modify the Hosts file on your local machine. In this case given you would add the following line (using the tab key to create spae between the name and the IP address) to the /etc/hosts file and then save the file.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.