🤝

HELO/EHLO String Validation

Ensures the server identifies itself using a Fully Qualified Domain Name (FQDN) that resolves accurately.

RFC: RFC 5321 (Section 4.1.1)
STAGE: SMTP Greeting
MATCH: A Record -> PTR Record

What is HELO/EHLO String Validation?

When a mail server connects to another, the very first command it sends is `HELO` (or `EHLO`), followed by its own name. If this name is fake or unresolvable, the receiving server will drop the connection.

How it Works

The tool extracts the provided EHLO identity string. It then performs a DNS lookup to see if that string resolves to the exact IP address making the connection. It also checks if the name contains invalid characters (like underscores).

Key Use Cases

Debugging why Yahoo/AOL immediately reject emails with "550 Invalid HELO".

Checking if misconfigured load balancers are passing internal IDs (like "localhost" or "web-server-01") instead of public domains.

Complying with strict European ISP formatting rules.

Advanced Details

A server sending `EHLO [192.168.1.5]` (an internal IP) over the public internet is a massive red flag. The FQDN used in the HELO string MUST have a public DNS A record.

Cybersecurity Pros & Cons

Security Advantages
  • Valid EHLO FQDN validation is a quick signal — spoofed or internally-leaking EHLO strings immediately flag misconfigured or malicious servers.
  • Consistent EHLO identity is required by many anti-spam filters; fixing it directly improves inbox placement rates.
  • Forward-confirmed rDNS (EHLO matches PTR matches A) is one of the strongest identity signals for legitimate mail servers.
  • Detecting "localhost" or private IP EHLO strings in production mail logs reveals serious server misconfiguration requiring immediate action.
Security Limitations
  • Any attacker with DNS control can set their EHLO FQDN to resolve forward and reverse, making it trivially spoofable.
  • EHLO validation alone does not confirm the server is authorised to send mail for the claimed domain — SPF handles that.
  • Legacy on-premises mail relays often use internal hostnames for EHLO, making strict validation impractical in hybrid environments.
  • Some legitimate cloud email services use generic FQDNs that do not reflect the customer's domain, causing confusion.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs