How to change HELO/EHLO in Postfix for InterScan Messaging Security

Süleyman Çelik
2 min readJun 2, 2021

When first using InterScan Messaging Security Virtual Appliance (IMSVA) I was irritated that the response to an EHLO was the internal FQDN of the server. I don’t like internal hostnames out in the wild, additionally, I want to make sure that the response to an EHLO exactly matched the DNS lookup.

There are several options available in the Web GUI, but this string did not appear to be one that could be configured.

Step 1: Connect to the CLI

ssh to the server using the root account created during initial installation

Step 2: Locate and open the Postfix config file

Use an text editor of your choice to open the file: /opt/trend/imss/postfix/etc/postfix/main.cf

Step 3: Add strings to the config file

While these lines can be done anywhere in the file, I’m anal and prefer to do it in the appropriate section.

Under INTERNET HOST AND DOMAIN NAMES add the following line: your-mx.yourpublicdomain.com

Under the next commented out paragraph, add the line: yourpublicdomain.com

Step 4: Restart Postfix

Run the following commands: postfix stop postfix start

Step 5: Test

Depending upon your setup, you may or may not be able to test this from inside your network. From inside, you can just telnet to the host on port 25, type EHLO test.test.com and hit enter. The response should include the public facing name of your mail exchanger.

If you need to test from an external source, I prefer mxtoolbox.com. Enter your domain name, then choose SMTP test when the results are displayed. Alternatively, you can just run smtp:(ip addy of your MX). When the test is complete, you’ll see the SMTP log displayed on the webpage, you can review the EHLO response for accuracy.

--

--

Süleyman Çelik

Network Security Engineer, SOC-Siem Engineer, Cyber Security Researcher, Vulnerability Management Specialist | CEH | CNSS