[BUG] verifier_domain is used as HELO argument and has much stricter requirements

[AlexeyDemidov]

As verifier_domain is used as HELO/EHLO argument during SMTP session it has much stricter requirements than the documentation implies and default value derived from verifier_domain can cause failure to establish SMTP session. By RFC 5321 HELO/EHLO argument should contain FQDN of the server which initiated SMTP session, and many SMTP servers implement strict HELO checks where they check that IP which initiated connection has PTR record which matches FQDN presented in HELO. So, if this check is run on a server with IP 1.2.3.4 which has PTR record 1-2-3-4.hosterdomain.com then HELO argument should be 1-2-3-4.hosterdomain.com and also you need to make sure that 1-2-3-4.hosterdomain.com resolves into 1.2.3.4

[bestwebua]

Hi, @AlexeyDemidov! Checkout PTR check feature in last gem release. What you think about SPF, DKIM and DMARC implementation for next auditor feature?

[AlexeyDemidov]

I would suggest passing an IP to test as a parameter to host_audit (and I would call this function something different, like sender_verify). Currently, using Socket.gethostname and attempting to resolve resulting hostname into an IP is very unreliable way to get host IP - a host name can be non-FQDN (without full domain name) so it won't exactly match PTR, a hostname doesn't guarantee to resolve into any IP at all, it also won't resolve into actual IP used to connect to external servers (on many cloud VMs and/or servers behind NAT you'll get a private IP for a given hostname).

There is a missing step in PTR verification - it checks that PTR matches verifier_domain but it doesn't check that verifier_domain itself resolves into the given IP. For example, it possible to have an IP 1.2.3.4 to resolve into example.com but example.com itself can resolve into a different IP, like 4.3.2.1. In this case of mismatch many SMTP servers won't trust that email is coming from example.com and will mark it as suspicious.

Regarding SPF, DKIM and DMARC - it could be useful to implement DMARC and SPF checks as a part of sender verification functionality (DKIM is impossible to check on SMTP level) but parsing these DNS records is quite complex, so it will be necessary to use 3rd party gems to implement it (https://github.com/trailofbits/dmarc and https://github.com/trailofbits/spf-query). In long term it would be probably better to split sender verification functions into a separate gem.

[bestwebua]

Alexey, thank for your details! I have fixed it. Cheers!