How to check the outgoing HELO name of the sendmail server

emailsendmail

My email server got blacklisted and I get the following message from Zenhaus CBL:

X.X.X.X. was found to be using the following name as the HELO/EHLO parameter during connections: "localhost.localdomain".

Unfortunately there were too many requests and CBL does not let me remove the blacklisting. Also I have absolutely no experience with sendmail and I don't know how to debug it/where to start, because this is what needs to be fixed first.

How can I check the HELO value by myself on the CLI?

Has anyone experienced a similar problem and can help me get sendmail running again without being blacklisted?

P.S:

The strange thing is that the same configuration worked before (I made a P2V migration from a physical machine to a virtual machine) and I never got blacklisted before the migration on the old physical server. The only thing I forgot to do after the P2V migration was changing the reverse DNS (but still this seems to not have anything in common with HELO name).

Best Answer

It is typical for all mail providers to log the HELO/EHLO parameter in all mail they process.

Open the headers (source) of a mail that anyone recently accepted from your server in question, it likely spells out your EHLO in one of the Received: headers. The topmost Received header mentioning your IP will contain two names: first the name you provided in HELO/EHLO, and the one obtained from looking up your network address. Usually the one next to the address literal [IP] is is rDNS name.

Received: from localhost.localdomain
  (mx7.yourdomain.example [192.0.2.2])
  by example.net (Postfix)
  with ESMTPS
  id ABC12345
  for <mary@example.net>;  21 Nov 1997 10:05:43 -0600

The relevant specification of what mail servers should put there is found in RFC 5321 Section 4.4

When an SMTP server receives a message for delivery or further
processing, it MUST insert trace ("time stamp" or "Received")
information at the beginning of the message content [..]

The FROM clause, which MUST be supplied in an SMTP environment, SHOULD contain both (1) the name of the source host as presented in the EHLO command and (2) an address literal containing the IP address of the source, determined from the TCP connection.

Do note that some list complaining about you using a bad name does not necessarily mean the server you are currently configuring used that name. You or a previous owner of your network address could theoretically have connected to a system reporting to that list operators via other clients.

Do also note that a list operator claiming a high number of requests about a network address is a very bad sign. List operators expect that their blocks lead the affected party to thoroughly investigate before even thinking of requesting removal from the list. Be sure to confirm that the listing indeed was meant for you, specifically (e.g. see IPv6 specific explanations here) and you have firmly established that the problem has been pinpointed and fully resolved.