helo email checking

This bug was reported to the dev list on 5th June 2006: https://lists.webarch.co.uk/pipermail/mkdoc-dev/2006-June/000327.html

Two MKDoc servers keep getting listed on the CBL email spam list, http://cbl.abuseat.org/ — whenever someone with a gmail account registers with a MKDoc site the server gets blackholed.

This is down to the use of Mail::CheckUser http://search.cpan.org/~ilyam/Mail-CheckUser-1.21/CheckUser.pm in flo/plugin/Account/Subscribe.pm — this is what the CBL says:

The Perl CheckUser module defaults to improper “HELO” and “MAIL FROM” strings: “localhost.localdomain” and “check at user.com” respectively. The former is illegal, the latter impersonates user.com – they probably don't like that. [Besides, by not using your own domain, some spam filters will lie to your RCPT TO.]

You will need to change $Helo_Domain = to be “<DNS name of your server>” and change $Sender_Addr to be something in your domain (eg: “check@<mydomain>”)

http://cbl.abuseat.org/linuxnonserver.html

If you run ethereal and capture the helo MKDoc does indeed use the default of localhost.localdomain and the default email address of check at user.com.

Subscribe.pm needs to be fixed so that it uses the MKDoc public domain for the helo and the admin email address for the check.

See the attached screenshots for the ethereal results.

These are the variables that need to be set in Subscribe.pm:

$Mail::CheckUser::Sender_Addr
   MAIL/RCPT check needs an email address to use as the 'From' address when performing its checks.
   The default value is [email protected].
$Mail::CheckUser::Helo_Domain
   Sender domain used in HELO SMTP command. If undef Net::SMTP is allowed to use its default value.
   By default it is undef.

http://search.cpan.org/~ilyam/Mail-CheckUser-1.21/CheckUser.pm

Login

helo email checking