localhost.localdomain in "Received" headers

[Brian Collins]

We have a customer whose employer rejects his mail if it comes through our
mail filter. The reason they give is:
"The mails are rejected because of a bad SMTP header. One of the "Received:"
field begins with "From localhost.localdomain" which is not accepted for
security reasons by our Internet mail gateways for security reasons."

Well, sure enough, headers for mail that comes through my filter looks
kinda like this: (this is from a message I sent to my Hotmail account)

Received: from mx01.numail.org ([216.130.129.64]) by mc4-f37.hotmail.com
with Microsoft SMTPSVC(5.0.2195.5600); Wed, 1 Oct 2003 08:05:46 -0700
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by
mx01.numail.org (Postfix) with ESMTP id 881092D807B for
<***@hotmail.com>; Wed, 1 Oct 2003 11:05:13 -0400 (EDT)
Received: from mx01.numail.org (localhost.localdomain [127.0.0.1]) by
localhost.localdomain (VaMailArmor-2.0.1.14) id 21641-51075AE4; Wed, 01 Oct
2003 11:05:10 -0400
Received: from pc15-6.nwl.org (pc15-6.nwl.org [172.18.15.6]) by
mx01.numail.org (Postfix) with ESMTP id 98E222D8097 for
<***@hotmail.com>; Wed, 1 Oct 2003 11:05:10 -0400 (EDT)

That seems normal to me, since we filter the mail through Vexira. At the
same time I can understand their wish to reject mail with a "Received"
header containing localhost.localdomain.

So, my question is: what, if anything, have I configured wrong? This
server processes tens of thousands of messages from our customers outbound
daily, and this is the first such complaint I've had.

Is their company wrong to be that strict? Or do I need to modify my
configuration?

master.cf follows below...

Thanks!
--Brian

# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (50)
# ==========================================================================
smtp inet n - y - - smtpd
pickup fifo n - y 60 1 pickup
cleanup unix n - y - 0 cleanup
qmgr fifo n - y 300 1 nqmgr
rewrite unix - - y - - trivial-rewrite
bounce unix - - y - 0 bounce
defer unix - - y - 0 bounce
flush unix n - y 1000? 0 flush
smtp unix - - y - - smtp
brokensmtp unix - - y - - smtp -o
smtp_never_send_ehlo=yes
showq unix n - y - - showq
error unix - - y - - error
virtual unix - n y - - virtual
lmtp unix - - y - - lmtp
cyrus unix - n n - - pipe
flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender -
$nexthop!rmail.postfix ($recipient)
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient

# Vexira implementation
localhost:smtp-backdoor inet n - n - - smtpd -o content_filter=

relay unix - - n - - smtp
proxymap unix - - n - - proxymap

[Ralf Hildebrandt]

Post by Brian Collins
"The mails are rejected because of a bad SMTP header. One of the
"Received:" field begins with "From localhost.localdomain" which is
not accepted for security reasons by our Internet mail gateways for
security reasons."

What are these security reasons?

[Jim Seymour]

Post by Brian Collins
We have a customer whose employer rejects his mail if it comes through our
"The mails are rejected because of a bad SMTP header. One of the "Received:"
field begins with "From localhost.localdomain" which is not accepted for
security reasons by our Internet mail gateways for security reasons."

Wow! "for security reasons" is stated twice! They must *really* be
serious! *snerk*

Post by Brian Collins
Well, sure enough, headers for mail that comes through my filter looks
kinda like this: (this is from a message I sent to my Hotmail account)

[snip]

Post by Brian Collins
... this is the first such complaint I've had.
Is their company wrong to be that strict? Or do I need to modify my
configuration?

[snip]
In *my* opinion: Yes, they're being silly. If for no other reason
than the fact that anything before the "Received:" line ones own MTA
puts in cannot be trusted. (One is inclined to wonder what they
think of "Received:" headers with un-resolvable hosts in RFC 1918
networks in them?)

That being said: Their network, their rules. They have every right
to be silly ;). I'm sure there are rules I employ that others might
regard as equally brain-dead.

ObUsefulContent: Maybe you can get rid of the offending headers with
header_checks IGNORE rules?

[Noel Jones]

Post by Brian Collins
That seems normal to me, since we filter the mail through Vexira. At the
same time I can understand their wish to reject mail with a "Received"
header containing localhost.localdomain.
So, my question is: what, if anything, have I configured wrong? This
server processes tens of thousands of messages from our customers outbound
daily, and this is the first such complaint I've had.

I think they are overly strict. Apparently they feel differently.

There are two things you can do to fix this on your end. 1) configure
Vexira to HELO with a different name - I suppose that's possible, but I
don't use Vexria. 2) add a header_checks IGNORE rule to your postfix
reinjection instance that will match this header and remove it.

[Brian Collins]

Post by Ralf Hildebrandt

Post by Brian Collins
"The mails are rejected because of a bad SMTP header. One of the
"Received:" field begins with "From localhost.localdomain" which is
not accepted for security reasons by our Internet mail gateways for
security reasons."

What are these security reasons?

They didn't tell him that. Probably for security reasons. ;-)

--Brian

[Brian Collins]

Post by Jim Seymour
Wow! "for security reasons" is stated twice! They must *really* be
serious! *snerk*

Yeah, I noticed that, too.

Post by Jim Seymour
ObUsefulContent: Maybe you can get rid of the offending headers with
header_checks IGNORE rules?

Thanks. I'll look into that.

--Brian

[Brian Collins]

Post by Noel Jones
There are two things you can do to fix this on your end. 1) configure
Vexira to HELO with a different name - I suppose that's possible, but I
don't use Vexria

Vexira runs on localhost port 10024. There is a setting in the config file
for "MyHostName", which I have set to mx01.numail.org. Apparently, since
it's listening on localhost, it doesn't use that. I'll check with their
support folks.

Post by Noel Jones
. 2) add a header_checks IGNORE rule to your postfix reinjection instance
that will match this header and remove it.

That sounds good. Yours is the second suggestion to do that, so I'll dig
into that a bit.

Thanks for the responses,
--Brian

[Covington, Chris]

How about changing your /etc/hosts so that 127.0.0.1 first resolves to
something other localhost.localdomain?

Like:

127.0.0.1 myserver localhost.localdomain localhost

Chris

[Ralf Hildebrandt]

Post by Brian Collins

Post by Ralf Hildebrandt

Post by Brian Collins
"The mails are rejected because of a bad SMTP header. One of the
"Received:" field begins with "From localhost.localdomain" which is
not accepted for security reasons by our Internet mail gateways for
security reasons."

What are these security reasons?

They didn't tell him that. Probably for security reasons. ;-)

Yeah all the wrong reasons. What are they, the NSA?